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SECTION 1 


INTRODUCTION 

This report presents the results of a two-year effort sponsored by the 
NASA Langley Research Center under contract NAS1-17411 to develop automatic 
control design procedures for restructurable aircraft control systems. The 
restructurable aircraft control problem involves designing a fault tolerant 
control system which can accommodate a wide variety of unanticipated aircraft 
failures. Under NASA sponsorship, ALPHATECH has been developing and testing 
many of the technologies which make such a system possible. Future work under 
this contract will focus on developing a methodology for integrating these 
technologies and demonstration of a complete system. 

The automatic control design procedure developed during the first year of 
this project [1]* assumes that failures are correctly detected and identified 
and makes use of feedforward and feedback controls to stabilize the aircraft 
and recover as much dynamic performance as is possible. The objectives of the 
work reported herein are to (1) thoroughly test the feedback control redesign 
procedure under a variety of failure conditions and (2) complete development 
of an automatic feedforward "trim" algorithm. 

This project was divided into three tasks. Task 1 involved performing a 
complete linearized analysis of the feedback control redesign procedure for 
the Boeing 737 aircraft. This included examination of eigenvalues, singular 

*References are indicated by numbers in square brackets; the list appears at 
the end of of this report. 
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values and linear simulations for a variety of failure and control redesign 
options. Task 2 was aimed at examining the performance of the various ele- 
ments of the overall control redesign procedure on NASA Langley Research 
Center’s nonlinear simulation. Finally, Task 3 completed development of an 
algorithm to automatically trim the aircraft with feedforward control and 
developed the integrated control system redesign procedure. 

1 .1 BACKGROUND 

As aircraft become increasingly sophisticated, and as static stability 
is decreased in the interests of efficiency and maneuverability, the potential 
damage caused by unanticipated failure increases dramatically. Although pilots 
can be trained to react in the case of anticipated major failures, they cannot 
be expected to respond correctly, and in time, for all conceivable failures. 

This is particularly frustrating because modern aircraft, with complex controls, 
may remain controllable despite individual failures, as happened recently in 
two well publicized cases. In one case, (a Delta L1011 flight [2]) the pilot 
was able to reconfigure his available controls to save the plane. In another, 
(the Chicago DC10 crash [3]) the pilot could not, although hindsight revealed 
the plane could have been saved. 

The objective of a restructurable control system is to automatically and 
quickly solve the control problem facing a pilot during an emergency. The 
class of problems of interest includes those where the failure or failures are 
unanticipated, but excludes those unsolvable areas (wings falling off) where 
the plane cannot be saved. 

The general area of emergency control modification can be divided into 
two categories: reconfigurable and restructurable control. The first cate- 

S or y includes failures which can be anticipated and solved in advance such as 
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engine or instrument failures. The most important failures in this class are 
analyzed and pilots are trained in emergency procedures to compensate for 
them. The major advances in reconf igurable controls in the near future may be 
expected to occur in computer storage and automatic activation of pre-solved 
emergency procedures. This involves computerizing "the book", and ensuring 
that emergency procedures do not simply rely on pilot training and memory 
under stress. 

The second class of problems, and the one of interest here, includes 
those emergencies which cannot easily be anticipated and planned for. It 
includes those cases where "the book" must be thrown out. Ideally, the solu- 
tion to this class of problems would place the experience and expertise of the 
best pilots and aircraft control system designers immediately at the disposal 
of the pilot in trouble. Such experts would analyze the problem and recommend 
solutions (some, perhaps, unconventional). Their actions would return the 
aircraft to a safe operating condition, and they would remain available to 
answer "what if" questions for the remainder of the flight, in particular 
involving changes to the aircraft to prepare for landing. 

This assembly of experts would, in fact, be answering the following 
questions : 

1. Did a failure occur? 

2. What failure(s) occurred? 

3. Must I restructure the controls to accommodate the failure(s), 
and if so, how? 

4. What else will happen if I change the controls? 

The first two questions constitute failure detection and identification, 
(FDI) and have received much research interest in the last decade [4]— [14] • 
Automatic techniques exist for determining whether a failure has occurred and 
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for isolating the failure component. Significant advances in designing robust 
FDI systems which can accomplish their mission with "real world" plant uncer- 
tainty and disturbances have recently been made and some early prototypes are 
being tested [4]— [5] - 

If a new aircraft model were available from an FDI system, a reliable 
automatic procedure would be required to answer the third and fourth question. 
Control restructuring must take place when a failure is beyond the accommoda- 
tion capabilities of the normally configured aircraft. Thus an FDI system 
must provide an estimate of failure severity in order for a decision about the 
need for control restructuring to take place. When required, a restructuring 
of the control system then provides the desired forces and moments on the 
aircraf t in spite of the failure. Techniques for accomplishing this control 
redesign were the topic of the first year's effort of this contract. 

1 .2 AN INTEGRATED APPROACH TO RFCS DESIGN 

The development of an integrated Restructurable Flight Control System 
(RFCS) is best viewed as a problem in failure accommodation. As indicated in 
Fig* 1 — 1 » failures can be accommodated either passively or actively. 

Passive fault tolerance can be thought of as robustness — the aircraft 
with its normal flight control system (including the pilot) can tolerate 
certain failures without modification. Other failures, however, may be too 
severe for the normal (i.e., any acceptable normal) controller to handle, 
and thus require active system modification. This modification involves 
(implicitly or explicitly) two processes: (1) failure detection and identi- 

fication (including identification of the post-failure system model) and 
(2) control system reconfiguration in light of the identified failure. 
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Figure 1-1. Failure Accommodation Decomposition 


A successful near-term RFCS has to possess several characterisics. These 
include: 

1. the ability to handle variations due to failures whose impact 
ranges from negligible to nearly debilitating, 

2. the ability to perform in a highly uncertain and noisy system 
environment , 

3. the ability to degrade gracefully with the severity of the 
failures, and 

4. the ability to maintain the aircraft performance during and 
after reconfiguration. To accomplish these goals both 
passive and active failure accommodation methods are needed. 

Figure 1-2 provides a functional component description of a RFCS which 
exploits both passive and active failure accommodation. This system consists 
of a robust multivariable flight control system, a failure detection and iden- 
tification algorithm and a procedure for automatic control system redesign. 

A robust multivariable flight control system is essential to any RFCS. 
This system must exploit the inherent control redundancy in the aircraft to 
minimize the effects of actuator failures and other damage. Of course, it is 
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R-1996 


Figure 1-2. RFCS Component Decomposition 

unlikely that a robust control system alone would be sufficient to handle the 
wide range of failure/damage modes. Such a system would require infeasibly 
high loop gains and bandwidth, must unacceptably compromise the performance of 
the unfailed aircraft, or would require unnecessarily complex FCS hardware to 
achieve reliability. However, a properly designed robust flight control sys- 
tem applied to the unfailed aircraft will be able to handle the less severe 
failure/damage modes, and will lengthen the time available for reconfiguring 
the FCS. 
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The more severe failure/damage modes will require a reconfiguration of 
the FCS • As indicated in Fig. 1-2, the reconfiguration is initiated by a FDI 
system. The problems of false alarms and missed detections are minimized by 
combining the FDI system with a nominal robust control system. As noted, 
the nominal control system is designed to handle as many as possible of the 
failure/damage conditions. The FDI system is then only required to handle 
failure/damages that severly impact performance. As the severity of the 
impact of a failure on the aircraft performance increases, the urgency of 
reaction increases and the time available to reconfigure decreases. However, 
this trend is compensated by the corresponding increase in the signature of 
the failure, which reduces the required time for the FDI system to respond. 

This phenomenon, coupled with the effects of the robust control system and 
robust FDI design techniques should allow a properly designed FDI system to 
virtually eliminate the problem of false alarms and missed detection. 

The last component in Fig. 1-2 consists of an automatic control system 
redesign procedure and has been the primary focus of the research completed 
under this project [1], [15]— [17] • The automatic redesign module (ARM) uses 
the information about failures provided by the FDI system to modify the nominal 
robust FCS. To be effective, the new control system must be able to recon- 
struct the desired forces and moments as much as possible given the presence 
of large disturbances due to failures, and constraints on the control system. 
Since control system constraints were important in the design of the nominal 
robust control system, the engineering tradeoffs which went into that design 
should be reflected in the new control design. Furthermore, the ARM should 
be tolerant of FDI limitations. Incorporation of FDI uncertainty into the 
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redesign procedure will allow the new control system to hedge against imper- 
fectly detected or isolated failures* Finally, graceful degradation of per- 
formance as the severity of failure increases should be a property of the ARM 
and can be obtained by ensuring that the nominal control system is recovered 
by the ARM when no failures are present. 

1.3 OUTLINE OF THIS REPORT 

Ihe remainder of this report is organized as follows. Section 2 presents 
a precise description of the automatic control redesign problem. The problem 
is decomposed into finding feedforward control values which will (ideally) trim 
the aircraft and a modification of the nominal feedback control law which is 
used to remove the effects of uncertainty and provide as much dynamic response 
to pilot commands as is possible. Section 3 provides the details of the feed- 
forward "automatic trim" problem and provides an algorithm for its solution. 
Section 4 presents a redesign procedure for determining a new feedback control 
law. This redesign procedure is based on the linear quadratic (LQ) regulator 
problem, however, it is not necessary that LQ be used to design the nominal 
control law which is used during unfailed operation. Section 5 puts these 
two subsystems (automatic trim and control law redesign) together and shows 
how the solutions to these problems are implemented. Section 6 applies the 
techniques developed in Sections 3 through 5 to a model of a modified Boeing 
737 aircraft. An LQ design methodology is used to develop a robust feedback 
control law which forms the basis for the control law redesign procedure. 
Solutions to the trim problem are investigated for a variety of realistic 
failure modes, and a variety of linear analyses of the redesign procedure 
are performed for these same failure cases. The linear analyses include an 
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eigenvalue analysis and linear simulations. Section 7 describes an investi- 
gation of the two subsystems using the NASA Langley Research Center's nonlin- 
ear aircraft simulation. Finally, a summary and conclusions are provided in 
Section 8. 
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SECTION 2 


PROBLEM FORMULATION 

In this section, we provide a precise description of the restructurable 
control problem and discuss some of the desirable features which any solution 
should contain. 

We assume that under normal operation, the motion of the aircraft can be 
described by the nonlinear, time invariant differential equation, 


X = f 0 ( x , u) 

(2-1) 

y = ho(x,u) 

(2-2) 


x is the n-dimensional state vector and u is an m— dimensional vector 
of controls (e.g., all control surfaces, engine controls, possible thrust 
vectoring, etc.) and y is a vector of "important" quantities ( not necessarily 
measurable ) . The unfailed aircraft is said to be "trimmed" when 


f 0 ( x T» U T> = 0 

(2-3) 

h 0 ( X T > U T ) * yd 

(2-4) 


for some constant values of (x T ,u T ) with y<j being the desired values of the 
important quantities (e.g., flight path angle, forward velocity, angular 
rates, etc.). Furtherfore, we will assume that a nominal control system is 
employed (for stability augmentation, control augmentation, disturbance 
rejection, etc.) and takes the form, 
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u = G 0 x + u r 


(2-5) 


where in general, the feedback gain, G Q , may be a function of flight condition 
and u r is a dynamic reference signal which is ultimately derived from the 
pilot inputs, r. Note that Eq. 2-5 assumes that any feedback compensator 
dynamics are embodied in Eq. 2-1. 

In general, those aircraft failures which potentially result in emergency 
conditions can be modeled by 


x = f F (x,u) + w 

(2-6) 

y = h F (x,u) 

(2-7) 


Equations 2-6 and 2-7 include changes in the aerodynamics of the aircraft, 
changes in control effectiveness, and potentially large disturbances (e.g., 
due to a stuck, off-centered control surface). The nominal control gain, G 0 , 
is typically designed without the effect of failures in mind. However, a 
large degree of fault tolerance may be achieved by proper choice of G 0 . If 
G 0 distributes the control authority amongst a variety of surfaces then any 
single surface failure becomes less critical in terras of reduction in command 
following performance. Furthermore, the use of integral action in the com- 
pensator (i.e., high loop gains at low frequencies) may allow the aircraft to 
recover automatically from a failure. That is, it may be possible to achieve 


f F (x F ,u F ) - 0 

(2-8) 

h F (x F ,u F ) = 

(2-9) 


automatically for some failures with the proper choice of G 0 . 
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Naturally, there will be some failures (or combination of failures) for 
which the nominal control system is not adequate. In these cases, we want to 
find a new control law of the form, 

u = Gp. X + u r F + U F T (2-10) 

where Gp represents a new feedback gain, u r ^ represents a new pilot reference 
signal and u F is a feedforward control that can be used to (approximately) 
reject the disturbances, w. The control system redesign problem becomes, 
therefore, one of choosing Gp,up, and the relationship between u r ? and the 
pilot inputs, r. These choices are made so that the aircraft is stabilized, 
disturbances can be rejected, the aircraft will follow the pilot commands and 
(more importantly) so that the limitations of the aircraft are not violated. 
Furthermore, these choices must take into account the fact that the aircraft 
model in Eqs. 2-8 and 2-9 are uncertain since we may rely on some FDI algo- 
rithm to identify this model. That is, in addition to the performance goals 
and aircraft constraints, a degree of robustness which is typically greater 
than would be considered for a normal aircraft must be achieved. 

The automatic redesign algorithms developed for this project were devel- 
oped within this framework and address all of the issues discussed above. The 
nominal feedback control law is designed using an LQ design procedure which 
will distribute the control authority amongst all available surfaces. As a 
result, a large degree of fault tolerance is achievable with no reconfigura- 
tion. The feedback control redesign procedure uses the design parameters 
(state and control weighting matrices) of the nominal control law as a basis 
for any redesign. In this way, performance can be optimized while maintaining 
the bandwidth constraints that are embodied in the nominal design. Finally, 
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an automatic feedforward trim algorithm is developed so that any large dis- 
turbances due to a failure can be quickly accommodated. 

In the remainder of this report, we will review the control redesign 
algorithm developed for this project and demonstrate the performance and 
robustness capabilities of a nominal LQ control design and the new control 
system produced by the redesign procedure for a variety of failure modes. 
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SECTION 3 


THE AUTOMATIC TRIM PROBLEM 

The solution, of the automatic trim problem is one of the most time - critical 
components of the restructurable control system. This is because substantial 
deviations from the desired trim condition (following a failure) is likely 
to result in a situation where the remaining control authority available for 
recovery is insufficient. In this section, we present a formal description of 
the automatic trim problem and describe a decomposition of that problem which 
allows us to use fast and efficient algorithms in the solution procedure. 

3.1 THE NONLINEAR TRIM PROBLEM 

During normal flight, the motion of an aircraft with respect to some 
inertial reference frame can, in general, be described by the nonlinear time- 
invarient differential equations 


x = f o ( x , u) + 5 
y = h Q (x,u) 


(3-1) 


where x is an n- dimensional state vector, u is an m- dimensional control vector, 
C is a vector of (presumably unmeasurable) disturbances, and y is an output 
vector of important quantities. The aircraft is trimmed at the nominal values 
(x n ,u n ) when 


f o(x n ,u n ) = 0 
h o( x n» u n) = 0 


(3-2) 
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For example, during straight and level flight, nominal control settings, 
u n , are established which maintain steady state flight (x = 0) at constant 
altitude (flight path angle, y = 0 -a = 0) at some desired airspeed and 
heading and level wings. 

Following a failure, the aircraft dynamics are assumed to satisfy 


X = f(x,u) + £ + w 
y = h(x,u) 


(3-3) 


where w is a constant (or slowly varying) measurable disturbance vector. For 
example, in the case of a stuck actuator, w represents the force and moment 
disturbance that results from the constant nonzero deflection. Following a 
failure, then, a trim condition results when 


f(x n > u n) + w = 0 

h (x n ,u n ) = 0 


(3-4) 


The primary goal of an automatic trim function is to find a solution 
(x n » u n ) which satifies Eq 3-4. We can then apply the control u n to the air- 
craft directly (assuming no control system; linear combinations of x n and u n 
are applied when feedback is employed) and achieve a fast initial recovery. 

This result, of course, can only be achieved if the solution (Xn,^) is 
a feasible one. That is, certain constraints on the allowable values of x n 
and u n must be imposed. For example, restrictions on u n would include the 
travel limits on the control surfaces and the power limits on the engine 
inputs. Restrictions on x n represent the region of validity of the aircraft 
model in Eq. 3-3 and would include minimum airspeeds (e.g., above stall), 
angle of attack limits, and altitude restrictions. 
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Finally , in order to create a formal well- posed problem statement we note 
that two cases of special interest exist. In the first case, several solutions 
to Eq. 3-4 exist within the feasible region. In this case, we will choose a 
solution which minimizes the norm (e.g. , in a weighted least squares sense) of 
the difference between the vector (x^i^) and some "desired" vector (x n °,u n °). 
This allows us to ensure that maximal 'residual' control authority remains 
available for disturbance rejection and command following. The second case 
arises when no solution to Eq. 3-4 exists within the feasible region. In this 
case we will choose the solution which minimizes the norm (again, e.g., in a 
weighted least squares sense) of the left hand side of Eq. 3-4. 

Making the following definitions, we can now formally state the nonlinear 
trim problem. Let 

z = (x n ~ x n °, u n - u n °) 

F = { z : x n and u n are feasible solutions} 

D = (z : z = arg min(ilf(z) + wll + llh(z)H)} . 

The solution to the nonlinear trim problem, z*, is then given by: 

z* = arg min II z II 

Subject to (3-5) 

zeF, zsD 

That is, we want to choose a feasible z which satisfies Eq. 3-4 as nearly as 
possible, and if more than one such solution exists, to choose the one of 
least norm. 
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As discussed in [1], while the above problem statement accurately repre- 
sents the goals of an automatic trim system, solution methods may be compli- 
cated by the various nonlinear functions which are used to describe the 
system. Furthermore, these complexities may not be truly representative of 
the complexities which must be faced in establishing an adequate trim solu- 
tion. For example, for small enough perturbations about some nominal value of 
2 , Eq. 3-4 can be well approximated by a set of linear equations. As we will 
discuss subsequently, fast and efficient solution procedures can be utilized 
to solve Eq. 3-5 when Eq. 3-4 is linear. 

Making use of linear approximations, we can decompose the nonlinear trim 
problem into two subproblems which are solved (and possibly iterated upon) in 
order to determine a complete solution. The first subproblem is the operating 
point selection problem. The primary purpose here is to determine nominal 
values of the states (x n ) and control variables (u n ) which results in a 
trimmed unfailed aircraft. A linearized version of the aircraft dynamics 
about this nominal can then be determined and, the constraints, objectives 
and/or priorities for the second subproblem, the linear trim problem, estab- 
lished. The linear trim problem then solves for feasible perturbations from 
the nominal values which adequately reject the failure induced disturbances. 

The determination of a suitable operating point is a function of a number 
of factors and is based on the desired flight objective. For example, during 
a landing approach, it may be sufficient to select a single operating point 
which corresponds to level wings and some nominal flight path angle. If 
another flight path is desired, the pilot controls deviations from this 
nominal to achieve the desired result. A linearized model for this operating 
point can then be identified along with an estimate of the model’s "region of 
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validity." This region is then translated into constraints on the state and 
control perturbations for the linear trim problem. After examination of the 
solution to the linear trim problem, the operating point selection problem may 
take advantage of parts of the nonlinear problem in order to find a combina- 
tion of flight objective and linearized model for which an acceptable linear 
trim solution can be found. Included in this part of the operating point 
selection problem are such (nonlinear) factors as the use of "discrete” con- 
trol elements which primarily influence the linear model (e.g., fuel dumping 
and c.g. changes), the nonlinear effect of velocity and altitude changes and 
possible changes to the flight objective. 

3.2 THE LINEAR TRIM PROBLEM 

For the linear trim problem, we assume that a linearized model of the 
aircraft about some nominal states and controls can be given by: 

x p (t) = Ax p (t) + Bup(t) + w p (3-6) 

where Xp(t) is the perturbation of the state vector (xp = x - Xq, Up(t) is 
the vector of available control perturbations (u p = u - u Q ) and w p is a vector 
of constant disturbances. The vector Wp can be used to represent forces and 
moments generated by failed surfaces. 

The key quantities that are to be regulated can in general be denoted by: 

yp = Cx p (3_7) 

Elements of y might represent quantities such as altitude, bank angle, flight 
path angle, and rotational rate perturbations. The primary objective of the 
linear disturbance rejection problem is to automatically select x p and u p such 
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that y achieves some desired value in steady state. More precisely, the 
linear trim objective can be expressed as 


y P = yd (3-8) 

and 

0 = Ax p + Bu p 4- v p (3-9) 

As in the nonlinear trim problem, we will want to impose some constraints 
on the allowable perturbations (x,u) for which a solution will be sought. In 
the linear trim case, these restrictions must be more conservative in order to 
insure that the resulting trim solution remains within the region of validity 
of the linear model. In most cases, these constraints can be described as 
upper and lower limits on the allowable perturbations, viz., 


X L < X p < X|J 

u L < Up < uy 


(3-10) 


Equations 3-8 through 3-10 describe the objectives of the linear trim 
problem. Like the nonlinear trim problem, in order to form a well-posed 
optimization problem we must examine two special cases. When several solu- 
tions to Eqs. 3-8 through 3-10 exist, we will call the problem feasible and 
choose (xp,Up) to minimize the norm of the difference between (x p ,Up) and some 
desired value (xp°,Up°). In particular, we have: 
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Feasible Problem 


Minimize = Hx p - x p ° » + Hu p - u p °B 

Subject to 0 = Ax p + Bu p + w p 

Yd = Cx p (3-11) 

x L < x p < Xu 

ul < u p < uu 

Various norms and weighting matrices can be used in Eq. 3-11 as discussed 
in [18] • These choices can be made off-line based on the physical character- 
istics of the aircraft and its control surfaces. It should also be noted that 
^*9* 3—11 must be solved on-line after the disturbance w has been measured or 
estimated. However, in the least squares case, Eq. 3-11 is a standard quad- 
ratic programming problem for which a number of fast, efficient solution algo- 
rithms have been developed. 

If a solution to Eqs. 3-8 through 3—10 exists, it guarantees that the 
principal objectives can be satisfied. That is, the important quantities can 
be zeroed (Eq. 3-8), steady state flight is possible (Eq. 3-9), and no pre- 
specified state or control constraints have been violated (Eq. 3-10). It is 
possible, however, that Eqs. 3-8 through 3-10 overspecify the problem. In 
this case, it is impossible to achieve the objectives of the linear trim prob- 
lem at the chosen flight condition. However, a variation of Eq. 3-11 can be 
used to gain time to choose a new nominal flight condition or to achieve 
slowly degrading flight. The key is to try to minimize the size of both the 
important quantities, y p , and the state perturbation derivatives: 
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Infeasible Problem 


Minimize J 2 ® ilAXp + Bup + Wp II + tICXp - y<j It 

(3-12) 

Subject to X L * x p < xy 
U L < u p < U U 

The objective in Eq. 3-12 attempts to keep the size of the state deriva- 
tive and key quantities small. Again, various norms and weighting matrices 
can be used. A solution to Eq. 3-12 will always exist. As with Eq. 3-11, a 
least squares formulation of Eq. 3-12 leads to a quadratic programming problem 
and can easily be solved on-line using fast and efficient algorithms. 

As in the nonlinear trim problem, the two problems described above 
(feasible and infeasible) can be compactly described as follows. Let, 

z = (x p - Xp°, Up - Up°) 

F = {z : zl < z < zjj} 

D = (z : (Xp.Up) = arg min J 2 > 

The solution to the linear trim problem is given by, 

z* = arg min 

Subject to (3-13) 

zeF, zeD 

That is, we start by solving the infeasible problem (Eq . 3-12) and determining 
the optimal objective function, J2*. If, in fact, the feasible problem has 
a solution, then J 2 * = 0, and in general, more than one solution may exist. 

The second stage is to minimize the objective (Eq- 3-11) subject to the 
constraints of Eq. 3-10 and the constraint J 2 = J2** 
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This completes our discussion of the automatic trim problem and the 
decomposition of that problem into an operating point selection problem, and 
a linear trim problem. The linear trim problem provides a formulation which 
allows fast and efficient quadratic programming algorithms to be used when the 
norms are interpreted in the least squares sense. In the next section, we 
will describe a quadratic programming algorithm which takes special advantage 
of the structure of the problem (Eq. 3-13) and the constraint set, F. 

3.3 A QUADRATIC PROGRAMMING ALGORITHM 

In this subsection we describe a quadratic programming algorithm which 
takes advantage of the special structure of the problem described in the pre- 
vious section. The simplicity of the constraint set and the special nature 
of minimum norm quadratic programming problems will allow us to use fast and 
efficient methods in computing the necessary quantities for the algorithm's 
operation. 

As discussed in the previous section, the problem which we are attempting 
to solve is a least squares problem which can in general be represented by 

Minimize (J^ = z) 

Subject to z L < z < z y (3-14) 

ze | z : z = arg min J 2 = — (Fz - d) T (Fz - d) 

where the solution variables, z, are in R n , F is an mxn matrix and d is in R m . 
That is, of all the solutions, z, which minimize J 2 , we want the feasible one 
of the least norm. 
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3.3.1 Solution Procedure: Overview 


The most common solution procedure for any quadratic programming problem 
is the active set method [19]. This method is an iterative procedure in which, 
at each stage in the algorithm, the current iterate satisfies the inequality 
constraints in Eq. 3-14. 

The first step in the active set solution procedure is the selection of 
any feasible solution to the inequality constraints in (Eq. 3-14) (e.g., z=0 
when z^ < 0 and z\j > 0) and the determination of which of these constraints 
are active (i.e., satisfied with equality). 

Next, a step direction is obtained which minimizes J 2 in the subspace of 
active constraints. For the problem at hand, this minimization is obtained 
by simply removing the elements of z which are active (constrained) from 
consideration, partitioning F into active and inactive columns, adding the 
effect of the constrained elements to the value of d in Eq. 3-14, and finally, 
finding the remaining elements of z by using a singular value decomposition 
of the inactive part of F. Details of this procedure will be provided in the 
next subsection. Note here, however, that the singular value decomposition 
of a matrix provides a basis for its* range and null spaces and as such, will 
be used to find the minimum norm (of the remaining elements of z) solution if 
the reduced problem is under-constrained. 

The next step in the procedure is to check if the solution to the con- 
strained optimum problem found above is feasible. If any of the inequality 
constraints are violated, then the step direction (defined by the current 
feasible solution and the solution to the constrained optimization problem 
found above) is scaled so that the next iterate is also feasible. That is, 
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if a step in the direction of the constrained optimum runs into a currently 
inactive constraint, then that constraint is added to the set of active con- 
straints and the process above is repeated. 

If, at this point in the solution procedure, the number of constraints 
equals the number of elements in z, then the current iterate is at a vertex 
of the constraint region. In this case we then check a set of stopping 
criteria to see if a single active constraint can be removed. If this is 
possible, a constraint is removed and the above process is continued. If the 
step direction does not need to be scaled (i.e., no inactive constraints will 
be violated), then the stopping criteria are also checked and the algorithm 
continued if an active constraint can be removed. The algorithm terminates 
when the stopping criteria indicate that no active constraints can be removed. 

Stopping Criteria 

In order to determine if the current iterate is the solution which is 
sought, the algorithm must check if any of the currently active constraints 
can be removed. If no constraints are active or if no constraints can be 
removed, then the current iterate solves Eq. 3-14. Furthermore, if several 
constraints can be removed, we must choose one of these for the algorithm to 
be continued. (This is to avoid so called cycling problems such as those 
discussed in [19]). 

The method by which the above is accomplished is by the use of Lagrange 
multipliers [20]. In the solution to any constrained optimization problem, it 
is possible to compute or estimate such multipliers. The reason these quan- 
tities are useful is that they represent the price associated with the active 
constraints. That is, each multiplier indicates the sensitivity of the cost 
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function which is being optimized to a feasible perturbation of the current 
iterate in a subspace which corresponds to the remaining constraints. Thus, 
for example, if all multipliers indicate that the cost function would increase 
(for a minimization problem) then we may conclude that the current iterate is 
optimal. (Note, this is just a statement of the Kuhn/Tucker conditions given 
in [19], [20]). 

For Eq. 3-14, there are two cost functions (J^ and J 2 ) for which we 
desire Lagrange multipliers corresponding to the current set of active con- 
straints. In the procedure to be detailed in the next subsection, we first 
compute multipliers which correspond to the sensitivity of J 2 (Eq. 3-14) to 
the current active constraints. If these multipliers indicate that a set of 
constraints can be removed, we choose the constraint which reduces the cost 
the most (i.e., largest multiplier, in magnitude). If these multipliers indi- 
cate that no constraint can be removed to reduce J 2 , then we compute multi- 
pliers which correspond to the sensitivity of to the active constraints 

with the further restriction that the feasible perturbations lie in the sub- 
space defined by J 2 = J 2 * (where J 2 * = current value of J2)« As detailed in 
the next subsection, the latter computation is easily accomplished by comput- 
ing the singular value decomposition of the matrix F (in Eq. 3-14) augmented 
with appropriate selection matrices corresponding to the above constraints. 

The constraints associated with the largest cost reduction is chosen at this 
point. The stopping criteria are satisfied when, at this stage, no constraint 
can be removed. 

The algorithm described above is summarized as follows. 

1. Determine an initial feasible point, z^(k=0), which satisfies 
the inequality constraints. 


25 



2. Compute the optimum z (say z) , along the current set of 
active constraints. 

3. Compute the new step direction P = Kg(z-z k ) where a is chosen 
so that z k +i - z k + P is feasible. 

4. If Kg = 1 or if z k+1 is a vertex go to 6. 

5. Else: k = k+1, go to 2. 

6. Compute Lagrange multipliers corresponding to the active 
constraints for the problem of minimizing J 2 . 

7. If any constraints can be removed, remove the one which 
reduces J 2 the most. Update k = k+1. Go to 2. 

8. If no constraint can be removed, compute the Lagrange 
multipliers corresponding to the active constraints for 
the problem of minimizing subject to J 2 = J2*. 

9. If any constraint can now be removed, choose the one which 
reduces the most. Update k = k+1. Go to 2. 

10. Else: Done. 


3.3.2 Solution Procedure Details 

In this subsection we provide some of the details of the algorithm 
described above. The description here follows the steps outlined in the 
above summary description. 

Step 1: Initial Feasible Point 

For most purposes, an initial value of z = 0 will satisfy the inequality 
constraints. If this is not the case, an initial feasible solution can be 
easily chosen as any combination of upper and lower bounds zj/ , z^ ( tke nota- 
tion z * will be used to denote the i'th element of z) . 

Step 2: Solve Constrained Minimization Problem 

The upper and lower bounds on the value of any z^ cannot both be active 
at the same time. If we keep track of these constraints separately, somewhat 
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simpler computations can be achieved over those needed in the application of 
a standard quadratic programming algorithm to this problem. To keep track of 
these constraints, we define two index sets based on the current value of z; 


I L = (iiz 1 = z L i} 
Iu = {iiz 1 = Zyi} 


(3-15) 


We now define a matrix F c , 


Fc = [F L Fu] 


(3-16) 


where consists of the columns of the matrix F for all iel^ and Fy consists 
of the columns of the matrix F for all Also, let 

b T = [ b L T > b U T ] (3-17) 

where b^ and bjj are elements of the bounds on z (z^ and zjj respectively) cor- 
responding to all i e 1^ and all i e Iu respectively. 

In the subspace corresponding to the active constraints (indicated by 
Eq. 3-15) the objective function J 2 (see Eq. 3-14) can be written as 

J 2 = (Fz f - d) T (Fz f - d) (3-18) 


where 


F = the columns of F corresponding to all ^inactive constraints, 
(i.e., the ith column of F appears in F if i e (1^ U Iu) c A 
where c denotes complement), 


Zf = elements of z which are not constrained, 



Thus, the solution to the constrained minimization problem (i.e., minimize J 2 
subject to the active constraints remaining active) can be found by solving 
the unconstrained problem: minimize J 2 . Since this is just a standard least 

squares problem, the solution is formally given by 

z f = d (3-19) 

where F # represents the Penrose pseudo inverse of ?. Note that in the compu- 
tation of z f by Eq. 3-19, if the problem of minimizing J 2 is under-constrained, 
then Zf is the solution of minimum norm in the least squares sense (e.g., 
see [34]). 

The most reliable way to compute z f is through the singular value decom- 
position (SVD) of the matrix F. (Many of the issues associated with this 
problem are also addressed in [34].) If F is an m x n matrix of numerical 
rank r, then its SVD takes the form 


F = 

u i ^2 i 

Sl 

0 


V X T 



L ° 

E 


_ v 2 T 


= U S V T 

where 

Uf is an m x r matrix of left singular vectors, 

U 2 is an m x m-r matrix of left singular vectors, 

Sf is an r x r diagonal matrix of singular values each of which 
is greater than some prespecified tolerance, 

E is an m-r x n-r diagonal 'error' matrix, 

is an n x r matrix of right singular vectors, 

V 2 is an n x n— r matrix of right singular vectors. 
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Furthermore, U and V are orthonormal matrices (i.e., U^U = V^V = I). From 
these properties, one can show that V 2 is a basis for the null space of F and 
is a basis for its range space. The solution, Zf, to the unconstrained 
problem of minimizing J 2 can then be computed by 

z f = (V L ) (S x ) _1 (Uf ) T d (3-21) 

Step 3; Compute the New Step Direction 

The new step direction, P, is defined by the equation 

P = Kg(z - z k ) (3-22) 


where z k is the current iterate, 
z* = zl* for all i e II 

£i = Z yi f or a n i e Ijj 

zW = Zfj, where If(j) denotes the j-th element of If A (II U Ifj)C 

and where Kg is computed as follows. Let 


= min 



Kjj = min 



then K s is defined 


- Zk 1 
z 1 - z k i 

zu 1 - z k i 
z 1 - z k i 


by 


for all i: i e If , z* - z k * < 0 (3-23) 


for all i: i e If , z* - z k * > 0 (3-24) 


Kg = min {K L , % , 1} 


(3-25) 
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If Kq - 1, then no constraints need to be added. Otherwise, the index set 
(° r is u P da ted to include the index, i, which achieves the minimum in 
Eq. 3-23 (or 3-24). 

Step 6: Compute the First set of Lagrange Multipliers 

The first set of multipliers correspond to the problem of minimizing J 2 
subject to i e (1^ U Iy). These multipliers can be computed by forming the 
so-called Hamiltonian function [20], 


H “ J 2 ~ l " Z L^) " l ^U 1 ( z k 1 - zu 1 ) (3-26) 

j i 

and setting the partial derivative of H with respect to z equal to zero (i.e., 
solving one of the necessary conditions of optimality as given in [20]). Since 
the sets 1^ and Ijj are mutually exclusive, it can be shown that the desired 
multipliers are given by 


*1 T = [Al T > Au T ] 
= FT( F z k - d) 


(3-27) 


Step 7: Test Multipliers and Update Constraints 

Equations 3-26 and 3-27 indicate that the current solution is globally 
optimal if X^/ > 0 for all i and if X^ < 0 for all j. This can be seen as 

follows. At the current z k , z^ 1 = z L * and z k ^ = zy^ for i e I I and j e Ijj. 

Therefore, H(z k ) = J 2 (z k ). But, z k was obtained by minimizing H, so for any 

other Zfc, say z, H(z k ) < H(z). If z is feasible and if X^ 1 > 0 and X^* < 0, 

then, referring to Eq. 3-26, H(z) < J 2 (z). From these arguments, we have 

J 2( z k) < d 2( z ) for any feasible z; which is equivalent to stating that z^ is 
globally optimal. 
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If any of the Lagrange multipliers violate the conditions stated at the 
top of the previous paragraph, then the current iterate, z^, is not optimal 
and one of the constraints can be removed. If several of the multipliers 
violate the above conditions, the index, i, corresponding to the largest (in 
absolute value) of these multipliers is chosen as the index of the constraint 
to be removed. 

Step 8: Compute the Second Set of Multipliers 

The second set of multipliers corresponds to the problem of minimizing 
subject to i £(1^ U Iu) an< ^ ^2 remaining unchanged. That is, the problem 

Min Hz^ + Az II 2 

Subject to (z k + Az) £ F 
FAz = 0 

has the solution Az = 0, along the currently active constraints (this is how 
z k was determined in step 6) and Lagrange multipliers given by 

\ 2 T = (A 2 t )^ z k (3-28) 

where 

a t . [f t s l t Su T] 

S L (i,j) = 1 if I L (i) = j ; otherwise S L (i,j) = 0 
S y (i , j ) = 1 if Iy(i) = j ; otherwise Su(i,j) = 0 
x 2 T = Uf T . x 2L T > *2U T ] 
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As in Step 7, the condition of global optimality is X L i > o, < o. If 

any of these conditions are violated, we remove the constraint corresponding 

to the largest (in magnitude) Xji of those which do not satisfy the optimality 
conditions . 


At this stage, if no constraint can be removed, (i.e., the optimality 
conditions are satisfied) then the algorithm terminates with the current 
iterate as the solution. 


3.3.3 Scaling 

Convergence of the quadratic programming algorithm described in subsec- 
tions 3.3.1 and 3.3.2 is greatly dependent on the relative sizes of the ele- 
ments in F and d in Eq. 3-14. In Section 6.3, the effect of scaling on speed 
of convergence is demonstrated for the B-737 application. In general, we can 
transform Eq. 3-14 as follows. Let, 


z s ~ s z 1 z 
d s - S d -1 d 


(3-29) 


where S z and S d are diagonal weighting matrices. If the i-th diagonal element 
of S z is large, then the i-th element of z will tend to have larger values in 
the feasible problem. If the i-th diagonal of S d is large, then the error in 
the i-th disturbance direction will be larger. Problem (Eq . 3-14) then 
becomes 
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Min 


Jl “ 2 8 T 2 8 

Subject to S z “l < z 8 < S z ”l zjj 

z e {z : z - arg min J 2 - IF S • z g - S d • d g l 


where 

F s " F S z 


(3-30) 


3.4 LINEAR TRIM WITH UNCERTAINTY 

Until now, our discussions of the linear trim problem have focused on 
solutions for the case where both the disturbance w (see Eq. 3-3) and the 
control effectiveness matrix, B, were known exactly. As in the development 
of control redesign procedures ([1]), it is desirable to formulate a problem 
In which specific knowledge about relative uncertainty can be used. That is, 
for example, we would like to incorporate into the quadratic programming algo- 
rithm, the capacity for trading off the use of control surfaces which may have 
a large nominal, but uncertain effect for those which may have more certain 
but small nominal effects. Furthermore, we would like the algorithm to be 
able to distinguish between those disturbances which are well known and those 
which are uncertain so that excessive control authority is not lost in trying 
to compensate for a poorly modeled or estimated disturbance. 

We can accomplish these goals by formulating the trim problem with uncer- 
tainty in a similar vein to the development of control system redesign proce- 
dures [1]. Suppose, in Eq. 3-14, the matrix F and disturbance d are random 
variables with 

F = F n + AF 

E{AF) = 0 (3-31) 

E{AF T AF} = Qp 
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d ■ d n + Ad 


E{ Ad} - 0 (3-32) 

E{ Ad T Ad} - Rj 

where E(*) denotes expected value* 

Using Eqs* 3-31 and 3-32, the objective function J 2 (Eq . 3-1) can then be 
expanded as, 

J 2 * (Fz - d) T (Fz - d) 

= z T F n T F n z + 2 z F n T AF z + z T AF T AF z 

(3-33) 

- 2 d n T F n z - 2 d n T af z - 2 Ad T F n z - 2 AdT af z 
+ d n Td n + 2 d n T Ad + AdT Ad 


Since AF and Ad are random variables, J 2 is now a random variable. In order 
to provide a deterministic quantity which can be optimized in the linear trim 
problem, we must consider some kind of statistical average of ^ Two such 
averages are the average cost E{J2), and the mean square cost, E{J 2 ^} # 
average cost case is considered below. 

Minimum Average Cost 

Combining Eqs. 3-31 through 3-33, and assuming that Ad and AF are uncor- 
related, the expected value of J 2 is, 

E(J 2 ) = z T (F n T F n + Qf)z - 2 d n T F n z + d Q T d n + Rj (3-34) 

Equation 3-34 can then be put into standard form (Eq . 3-14) by completing the 
square resulting in. 
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where 

E{J 2 > - (Fz - d)t(Fz - d) + g 

(3-35) 


F T F - F„T F n + Qp 

(3-36) 


a ■ F„T d „ 

(3-37) 


d T d + g = d„ T d„ + Rj 

(3-38) 


The effect of including uncertainty information in the description of the 
linear trim problem and minimizing the average cost can be seen by examination 
of Eq. 3-34. The uncertainty in d results in a constant positive value (R) 
added to the cost, but does not change the optimal solution, z*, which mini- 
mizes E{ J 2 } • The uncertainty in F results in the addition of the term Z T q z 
to the cost. This term amounts to an additional weighting or scaling of the 
solution variables, z, that reflects the relative amount of uncertainty con- 
tributed by each element of z. Elements of z with large uncertainty contrib- 
ute more to the expected cost than do elements with small values so that the 
solution, z , will realize a tradeoff between the use of elements which have 
different nominal effectivenesses and different amounts of uncertainty associ- 
ated with their disturbance rejection capabilities. Note that uncertainty in 

the A, B, and C matrices in Eqs. 3-6 and 3-7 can be incorporated into this 
formulation* 

The average cost function described above provides a problem formulation 
that results in an automatic tradeoff between solution elements of various 
effectiveness and uncertainty. However, the uncertainty in the disturbance to 
be rejected does not affect the solution. Examining Eq. 3-33, we can see that 
while, on average. Ad only creates an increase in J 2 which is unrelated to 
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the choice of z (Ad"^ Ad term) , the actual value of Ad does create a z— dependent 
effect on the actual cost function* Thus, one would expect that the z— dependent 
impact of Ad on the cost occurs primarily in higher order moments of the cost 
function (e.g., E{(J 2 )2}). Minimization of the mean square cost is then a 
likely candidate objective function. The resulting solution to the minimiza- 
tion of such an objective would provide the desired tradeoff between the use 
of solution elements to cancel disturbances of uncertain effect. Disturbance 
directions, which are not well known, result in large mean square values of 
J 2 when certain elements of z in the solution are large. The algorithm would 
then balance this uncertainty with its ability to achieve the desired nominal 
disturbance rejection capability. Unfortunately, the computation of E{J2^} 
involves fourth-order moments of AF and Ad which would need to be specified 
(or derived from a Gaussian error assumption). Furthermore, the resulting 
objective cannot necessarily be factored in a form which results in a qua- 
d ra tic programming algorithm. Therefore, the minimum average cost provides 
the easiest method for incorporating knowledge about the uncertainty in F into 
the linear trim problem. 
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SECTION 4 


AN LQ-BASED CONTROL LAW REDESIGN PROCEDURE 

4.1 PRELIMINARIES 

The purpose of this section is to formulate and solve an optimization 
problem that forms the basis for the automatic redesign procedure. The pri- 
mary criteria for the automatic redesign optimization problem will be to maxi- 
mize the performance of the feedback system, in a specific sense, subject to 
constraints on the system bandwidth. The automatic redesign system will be 
based on Linear Quadratic design techniques [23]-[25]. The Kalman Equality 
[26] is used to determine the benefits that result from a LQ design and to 
formulate an approximation to the bandwidth constraints of the control system. 
A performance measure then is formulated to approximate these benefits. 

We will assume that the system is described in state variable form by: 

x ( t ) = AqX( t) + B 0 u( t) (4-1) 

where x(t) is an n-dimensional vector consisting of both the aircraft and 
control system compensation states, and u(t) is an m-dimensional vector of 
aircraft control effectors. It will also be assumed that the aircraft control 
system has been designed using LQ design techniques, and hence that the con- 
trol u(t) minimizes 

00 

J = / [xT C 0 T c Q x + uT R 0 u ]dt . (4-2) 

0 


37 


Hence, the control u(t) is given by 



u(t) - -R 0 -l B 0 T K x(t) A -G 0 x(t) 

(4-3) 

where K 

solves : 



AqT K + KAo + C 0 T c o - KB 0 R 0 "l B q T K = 0 . 

(4-4) 

For any state weighting matrix C 0 and any input weighting matrix R^,, 
the return difference D of the LQ feedback system with the loop broken at the 
input to the plant satisfies the Kalman Equality [26]: 

where 

D(-s) t R 0 D(s) = R d + L 0 (-s) T L 0 (s) 

(4-5) 


D(s) = I + G 0 (sl - Ao)"l B 0 

(4-6) 


L o(s) = C 0 (sl - Ao)* 1 B 0 • 

(4-7) 


Man y performance issues are most readily discussed in terms of sensi- 
tivity function (i.e., the inverse of the return difference) of the closed 
loop system evaluated at the plant input: 


S(s) = D(s)“l ( 4 - 8) 

The relationship of S to feedback system performance has been discussed exten- 
sively in the literature (c.f. 1 24 ]— [31]). In general, one obtains benefits 
from feedback at those frequencies for which 

US( joi) II < 1 / 4 _ 9 v 
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The benefits include improved response due to dynamic input disturbances and 
a reduction of the effects of parameter variation. The frequency range over 
which Eq. 4-9 can be achieved is generally limited by the dynamic uncertainty 
of the plant, sensors, and actuators. As a result of these uncertainties, the 
loop transfer function 

Us) = G 0 (sl - Aq)-! B 0 (4-10) 

must be rolled off before the uncertainties become significant. 

The bandwidth limitations on the loop transfer function L(s) (Eq. 4-10) 
can be imposed by unmodeled plant, sensor, or actuator dynamics. We will 
assume that these constraints can be expressed in terms of a constraint on 
the norm of the loop transfer function at the input of the closed loop plant 
of the following form: 


»PL(jm c )0 < 1 . (4-11) 

In condition 4-11, w c represents a frequency (typically the loop cross- 
over frequency) at which bandwidth constraints are to be modeled. Since the 
loops of a multivariable system can have different bandwidths, the weighting 
matrix P is used to model the relative maximum size that the control loops 
may have at a frequency chosen to model the constraints. In effect, the 
matrix P can be regarded as scaling the input matrix for redesign synthesis 
and analysis purposes. The ability of this constraint model to accurately 
represent effects of the true physical uncertainties (such as actuator rate 
limits and aeroelastic phenomena) relies on the ability to represent all these 
effects at a single frequency. In a general design setting, such a represen- 
tation is usually not possible. However, by assuming that the original design 
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for the unfailed aircraft satisfied all such constraints and by retaining any 
augmented dynamics (such as notch filters or dynamics that add additional 
rolloff in the loop shapes), the constraint model (Eq. 4-11) becomes useful. 
Thus, the higher frequency loop shapes of the original design will be quali- 
tatively retained and the constraint model (Eq. 4-11) will force the quantita- 
tive constraints. This use of the constraint model (Eq . 4-11) will be adopted 
by the automatic redesign procedure developed in subsection 4.2. 

The constraint 4-11 uses the control loop gain G explicitly. Since the 
gain G is related to the LQ design parameters C and R in a complex, nonlinear 
manner, it is desirable to approximate Eq. 4-11 with a constraint that employs 
C and R explicitly. Fortunately, a simple approximation to Eq. 4-11 can be 
obtained from the Kalman Equality (Eq. 4-5). 

The attempt to ensure that the loop transfer function is small (i.e., 
condition 4-11 can be roughly approximated by trying to keep the return dif- 
ference small (i.e., near unity). The latter can be accomplished by con— 

trolling the size of the right-hand side of Eq. 4—5. Let N denote the square 
root of Rq - ^: 

Ro ' 1 = N 0 N d T 


or 

Ro = No‘ T N 0 -l 


(4-12) 


After premultiplying Eq. 4-5 by N Q T and postmultiplying by N 0 , Eq. 4-5 
becomes : 


where 


[n 0 -1 D(-s) N 0 ] t [n q -1 D(s) No] = I + L c (-s)T L c (s) 
Lc( s ) = C 0 (sl — Aq) 1 B 0 N 0 . 


(4-13) 


(4-14) 
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Thus , we can approximately impose Eq. 4-11 by using the transfer function 
L c (s) in Eq. 4-11 rather the true transfer function L(s). That is, we can 
replace Eq. 4-11 by: 

IPC 0 (ju> c I - Aq)"! B 0 N 0 ! «; 1 . (4-15) 

Thus, Eq. 4-15 approximately represents the bandwidth limiations and is 
expressed only in terms of open loop and design quanities. 

4.2 DEVELOPMENT OF THE AUTOMATIC DESIGN PROCEDURE 

Given a failure of one or more aircraft control surfaces, the objective 
of the linear restructurable control system is to redesign the linear control 
law in a manner that preserves as much of the aircraft safety and performance 
as possible. Clearly, the primary objective is to stabilize the aircraft. 
Assuming that this is possible for the given flight condition and available 
actuator power and bandwidth, the secondary but still important objective of 
maintaining aircraft performance can then be considered. This objective can 
be translated into the control system objective of maximizing the amount of 
beneficial feedback in order to both maximize robustness due to uncertain 
system parameters and to minimize disturbance effects. 

The preceding considerations form the basis for the linear restructuring 
algorithm developed in this section. The automatic redesign procedure will 
use LQ regulator designs for the restructured FCS. Thus the design parameters 
to be chosen by the automatic redesign procedure are the quadratic penalty 
matrices C and R. 

We will assume that a nominal LQ design for the unfailed aircraft is 
available. The design can be characterized by the quadratic weights Cq and 
R 0 that were used to develop the nominal design. The automatic redesign 
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procedure exploits the engineering trade-offs that were made in the choice of 
C Q and R 0 for the unfailed aircraft by fixing the new state weights, 

C N " c o (4-16) 

and choosing new control weights, %. The choice of C N , as in Eq. 4-16, en- 
sures that the relative importance of each state (or combination of states) 
is maintained in the Linear Quadratic regulator problem for the failed air- 
craft design, thereby incorporating the physical engineering trade-offs from 
the unfailed FCS design in the restructured design. 

The remaining design parameter that must be specified by the automatic 
redesign procedure is the input penalty matrix R. The formal objective of the 
automatic design procedures will be to choose R to maximize performance in an 
appropriate sense while satisfying the bandwidth constraints (Eq. 4-15). 

Following a failure, we will assume that the automatic redesign module 
is supplied with estimates of the state and control matrices, Af and Bf of the 
failed aircraft . To simplify the presentation, we will assume that Af = Aq. 
The estimated control effectiveness matrix Bf will differ from the true con- 
trol effectiveness matrix Bf of the failed aircraft by an amount AB: 

B f = B f + AB (4-17) 

where AB represents the uncertainty in the effectiveness. We will assume that 
the uncertainty has zero mean: 


E { AB} = 0 (4-18) 

and that the covariance between the (i,j)th element and the (k,£.)th element is: 

E{ABfj ABfcjj,} = Bijkjj, • (4-19) 
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It should be emphasized that this error model for the uncertainty of the con- 
trol effectiveness coefficient is for the estimates of the failed aircraft 
coefficients. Since it is assumed that the nominal values are supplied by the 
FD1 algorithm, it is reasonable to assume that these estimates are unbiased. 

The post-failure control system performance is a function of the new gain 
G (which we wish to select) and is determined by the "size" of the return 
difference: 

D(s) “ I + G(sl - Aq) - 1 B f (4-20) 

Since *Bf is random, so is D(s). In order to ensure that D is large when 
control effectiveness uncertainty exists, we wish to choose G so that both the 
expected size of D is large and the expected size of the uncertainty about D 
is small. This can be done as follows. Define D(s) = D(s) N, where N is 
the square root of the new control weighting matrix The cost functional, 

which we wish to minimize, is: 


J = j| e{d(-s) T D(s)} - E j [D(-s) - E{d(-s) } ] T [D(s) - e{d(s)}] \ || 

The cost J will be large when the expected size of D is large and the expected 
size of the uncertainty is small. Using the Kalman Equality we can rewrite 
J as, 


J = 1 1 + N t Bf(-sl - Aq)-T C 0 T Co (sI - A 0 )" 1 B f N 

- N T E { AB T (-sI - Aq) -1 G T R N G(sI - Aq) -1 ab } n a 


(4-21) 


Equation 4-21 will be used as the measure of performance that is to be 
maximized by the choice of % (i.e., N) and, hence, G. We now define the 
norm in Eq. 4-21 as the trace of the integral of the frequency terms. 
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J - Tr{NT[W co - W U ]N} 

where 

W CO “ B f T w o B f 

w u - e{ab t w~ ab} 

00 

w 0 = / (-ju)I - A 0 )-T c o T C o (j0)I - A c )-l dm 
00 

Wo -/ (“jwl - a 0 ) _T G t R n G(jul - Ao)-l du . 


(4-22) 

(4-23) 

(4-24) 

(4-25) 

(4-26) 


Formulas 4-23 and 4-26 can be simplified. First, by using the approximation 

G T RG " c o T c o (4-27) 

Eqs. 4-25 and 4-26 become identical. By Parseval's theorem, if Aq has all 

its eigenvalues in the left half plane, W 0 is the solution to the Lyapunov 
equation: 

Ao T W q + W 0 T Aq + C 0 T c 0 = 0 . (4-28) 

If Aq has one or more eigenvalues in the right half plane, a stable factoriza- 
tion of Eq. 4-25 can be used to compute W Q from an analogous Lypunov equation. 
Assume that the system matrix has the spectral decomposition: 



(4-29) 


where A s is a diagonal matrix with its diagonal elements being the left half 
plane eigenvalues of Aq, and A u is a diagonal matrix with its diagonal ele- 
ments being the right half plane eigenvalues of Aq . Define 
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A - [W 8 W u ] 


( 4 - 30 ) 


A s 

0 


v 8 «“ 

_0 

-v_ 


- V u H _ 


Then W Q is the solution of the Lyapunov equation (Eq. 4-28) with A replacing 
A 0 . For computational purposes', W and V in Eqs. 4-29 and 4-30 can be replaced 
by any matrices that effect a decomposition of Aq into its stable and unstable 
invariant subspaces. Assuming that the system matrix is not significantly 
affected by the failure, these matrices can be computed off-line. If the 
failure effects on the system must be incorporated, the matrices can be com- 
puted efficiently and accurately. 

Finally, Eq. 4-24 can be rewritten as: 

n n 

V . = l l W 0 8kUj • (4-31) 

ij k=l £=1 k£ J 

where BkUj = E { AB ki AB £j} • 

The objective is to maximize J in Eq. 4-22. This is to be achieved sub- 
ject to the bandwidth limitations as expressed by Eq. 4-15. That is, we must 
satisfy, 

HPC 0 (jw c - Aq) - 1 B f Nil < 1 . (4-32) 

Using the Schwarz inequality, 

DPC o (j0) c - Aq) - 1 B f NH < !PC 0 (j<D c - Aq) - 1 B f N 0 H • HN 0 “1 Nil . 

If we are dealing only with failures that result in decreased effectiveness 
and/or decreased bandwidth, then 

«PC 0 (jco c - Ao) -1 B f N 0 l < 8PC o (j0J c - Aq)~1 B q N 0 I < 1 
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where the last Inequality comes from the assumption that the nominal LQ design 
satisfies the bandwidth constraints as modeled by Eq. 4-15. Thus, Eq. 4-32 
is achieved when N satisfies, 

IN 0 “1 N1 < 1 . (4-32b) 

Hence the objective of maximizing performance in the presence of control effec- 
tiveness uncertainty is formulated as solving Eq. 4-22 subject to Eq. 4-32b. 

4.3 SOLUTION OF THE OPTIMIZATION PROBLEM 
Define 

Y = N 0 “l N . (4-33) 

Then Eqs. 4-22 and 4-32b become: 

max Tr {Y T WY } ( 4 . 34 ) 

subject to 

UYI < 1 (4-35) 

where 

W = N 0 T[W C0 — W U ]N 0 . (4—36) 

The solution can be obtained in terms of the eigenvectors of W. Let the 
columns of Y be an orthonormal basis for the invariant subspace (eigenspace) 
of W corresponding to the nonnegative eigenvalues of W. Then Y solves Eqs. 

4—34 through 4—36. The matrix N is given by 

N = N 0 Y (4-37) 

and the design matrix R and is specified by 

% _1 = N N t . (4-38) 
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4.4 DISCUSSION 


Objective 4-22 has a nice interpretation in terns of the effectiveness of 
control on the important state variables. Recall that it was assumed that C Q 
has been chosen to reflect the relative importance of the various state vari- 
ables to the performance of the aircraft. The matrix BfT W D Bf then reflects 
the amount of energy that can be transmitted to those variables, weighted by 
their perceived importance, from each of the available control surfaces. 

Hence, Eq. 4-22 captures the issue of quantifying control effectiveness via 
the matrix W CQ . Objective 4-22 also captures the issue of quantifying control 
surface uncertainty through the matrix W u . Hence, the objective is to maxi- 
mize the beneficial feedback (W CQ ) minus the uncertainty (W u ) . 

The solution (Eqs. 4-37 and 4-38) reflects these issues. A negative 
eigenvalue of W results only if uncertainty exceeds benefit in some direction. 
This direction is represented by the corresponding eigenvector of W and is 
eliminated from consideratin in the control law design. Hence, the solution 
eliminates those combinations of controls for which the control uncer tainty 
exceeds the control effectiveness within the feedback design . 

The automatic design algorithm can be summarized as follows. It assumes 
that a nominal LQ design has been chosen with nominal weights C 0 and Rq. It 
also assumes that an FDI algorithm has indicated a control surface failure: 

Step 1 : Form the matrices Bf and N 0 . 

Step 2 : Compute W from Eqs. 4-23, 4-28 through 4-31 and 4-36. 

Step 3 : Find the eigenvectors Vf,...,V£ corresponding to the 

nonnegative eigenvalues of W. Define 

N = No [vi . 


47 



Step 4 : Compute 


Rn -1 * N N t • 

Step 5 : Solve the LQ regulator problem 

AqT K + KAq + C 0 Tc 0 - KB f R N -l B f T K = 0 
G = R n -1 B f T K . 

If W u = 0, the solution of the automatic redesign optimization problem 
(Eqs. 4-22 and 4-32) is almost trivial. Since 

W 0 > 0 (4-39) 

the objective functional, J, (Eq. 4-22) is also positive for any choice of N, 
and is monotonely nondecreasing as N increases in size. Thus, N should be 
chosen as large as possible. The only constraint on N is the bandwidth con- 
straint 4-32b. Hence the choice 

N = N 0 (4-40) 

solves the automatic redesign problem. 

Thus, in the case when information about control effector uncertainty is 
not used by the automatic redesign procedure, the procedure simply solves a 
LQ regulator problem with the new system description supplied by the FDI algo- 
rithm and the nominal design quadratic weights C Q and Rq. This has the advan- 
tage of not requiring any computation to choose the design parameters. Yet, 
since it is the solution to the automatic redesign optimization, this simple 
procedure effectively maximizes the achievable performance within the band- 
width constraints of the system. 
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4.5 EXTENSION OF THE REDESIGN PROCEDURE FOR PLANTS WITH INTEGRATOR STATES 

In this subsection, we modify the redesign procedure so that plants with 
integrator states (poles at the origin) may be handled. Recall that when we 
had unstable poles, a unique positive definite solution to the Lyapunov equa- 
tion was obtained by evaluating the observability Grammian for the same system 
with the unstable poles reflected about the joo axis. This procedure is neces- 
sitated by the fact that the procedure for computing the grammian guarantees 
a unique positive definite solution only when the system is stable. The 
grammian obtained by this method solves the desired frequency integral for 
the unstable system. 

When the system has poles at the origin, the desired frequency integral 
is infinite so we must modify the procedure to obtain meaningful answers. To 
begin our discussion, recall that the redesign procedure is based on maximizing 
some matrix norms of the frequency integral, 

oo 

W co = / L(s) L(-s) h ds (4-41) 

jd ) = -00 

where 

L(s ) = C(sl - A) -1 B (4-42) 

and 

Q = C T C (4-43) 


Furthermore, when the system has integator states, we can write, 


A = 



0 

0 


(4-44) 



(4-45) 
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“p 


M, 


(4-46) 


Q - 


Qp Qpi 
_Qpi t Qi J 


(4-47) 


where 


Qp - MpT Mp 
Qi = Mi? mj 
Qpi = MpT Mi 

Using Eqs. 4-44 through 4-47 in Eq. 4-22, we have 

L(s) = M p ( si - Ap)~l B p + — MiCi(sI - Ap)~l Bp . 


(4-48) 


At low frequencies, the second term in Eq . 4-48 dominates while at high fre- 
quencies, the first term is dominant. In the frequency region of interest, 
both terras may be important* 

The notion that a particular range of frequencies is of primary impor- 
tance can now be exploited for our purposes. Suppose we define a new loop 
transfer function, 

W(s) = L(s) • W(s) . (4-49) 

Then the integral (Eq. 4-41) using L^s) instead of L(s) is just a frequency 
weighted integral, 

/ L (s) H(s) L(-s) h (4-50) 

where 


H(s) = W(s) W(-s) H . 


(4-51) 
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The weighting W(s) can now be used to cancel the integrator poles and thereby 
make W co finite. 

To see how this is implemented, consider a simple example with. 


W(s) = I 


( 4 ) 


(4-52) 


Note that in general, one may want to use different frequency weightings for 


each loop (e.g., [W(s)] i:l = 


s + a. 


*)• Now although one could simply argue 


that the state matrix, A, with the additional dynamics for W(s), define a 
new Q matrix, and solve the Lyapunov equation, this procedure will result in 
numerical problems because of the implicit pole-zero cancellations. In order 
to avoid these numerical problems, we perform the pole-zero cancellations 

explicitly and develop a new A and Q matrix which results in the desired W co 
when the Lyapunov equation is solved. 

Using Eqs . 4—52, 4— 49, and 4—48, we have 


1^,(5) = Mp(sl - Ap) 1 Bp + M 1 c 1 (sl - A p ) _1 Bp 

s+a r s+a 


(4-53) 


Let W(s) be obtained from the minimal realization. 


with 


W(S) - Cyisl - A w ) 1 B w + Dy 


A w - -al 


Bw = I 


C w = -al 


(4-54) 


D w = I . 


51 


If we define, 


Ap 0 


•V "iCi - a Mp 


then it can be verified that 


^w( s ) C a (sl — A a )~l B a 


with 


Qa = C a T Ca = 


-aQp + QpjCj 


-aQpT + CjTQpjT CjTQjCj + a 2 Q p - aCjTQpjT _ aQpjCp 


Finally, 


W, co J Ms) L^( — s)^ ds 


is solved by the Lyapunov equation 


A a Tw o W 0 ^A a + Q a — 0 


(4-60) 


W C0 = B a T w Q B a . 


(4-61) 
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SECTION 5 


A PROTOTYPE RESTRUCTURABLE CONTROL SYSTEM 

This subsection will give an explicit description of the entire restruc- 
turable control system, so that the operation of the system can be seen. 

5 . 1 PRELIMINARIES 

We assume that we have our linearized aircraft model in state-space form 
x = Ax + Bu u e R m , x e R n 

y = Cx y s R p (5-1) 

x r = C r x x r e rI1_P 


C = | I • 0 

pxp pxn-p 


C r = 


0 • I 

n-pxp n-pxn-p 


x = 


where y are the important states that we would like to control very closely. 
Note that we must have (A,B) a controllable pair and (A,C) an observable pair, 
with rank (C) = p, rank (B) > p in order to independently control the output y. 

While the automatic trim system will attempt to reduce the effect of dis- 
turbances (e.g., stuck surfaces), there will always be some residual constant 
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disturbance that we didn't predict. In order to reject this disturbance com- 
pletely from those important states we need to add integrators. Thus, we form 
the new augmented system 


or 



(5-2) 


z = Az + Bu 


(5-3) 


We now pose the LQ problem for this augmented system: 
Find u(t) to minimize 


J = / [z t Qz + u T Ru ]dt 
0 

where Q = > 0 is rri-pxn+p and R = R? > 0 is mxm. 


The solution is given by 


u = -Gz = - 





where 


G = R -1 B t K 


y 


x r 


X 


I 


and K = > 0 solves 


(5-4) 


(5-5) 


(5-6) 


0 = A^K + KA + Q - KBR -1 B t K . (5-7) 

A command-following control system using this state-feedback gain G is shown 
in Fig. 5-1. Here, r is the desired deviation from the setpoint y 0 and is 
controlled by the pilot through some input shaping filter. 
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Figure 5—1. Command Following With LQ 

Due to the integrators, we will achieve y = r + y Q exactly in steady state 
(i.e., r = constant). The closed-loop system of Fig. 2-10 with r i 0 is 

z = A z + b[— Gz + u Q + Gz 0 ] (5—8) 


where u 0 and z 0 are the setpoints desired by the automatic trim system. They 
must satisfy 

0 = Az 0 + Bu q . (5-9) 


Note that we are selecting z Q 


X I0 


so that we can pick a setpoint for 


the integrator states xx* Suppose we pick xxo to be zero. That means that 
the integrated xalue of y = Cx must be zero (since xx approaches xxo i n steady 
state) and in general, we will obtain an overshoot in our initial condition 
response, even if all eigenvalues of A-BG are real . To see this, consider the 
simple example in Fig. 5-2, with the initial conditions 


xi(0) = 0 (5-10) 

X2(0) = -1 (5-11) 
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Figure 5-2. Simple Example Demonstrating Overshoot 
Since the system is stable, x^,X£ both decay to zero, but 

t 

X 1 ( t) = / x 2 (T)dx (5-11) 

0 


so that the area under X 2 (t) must go to zero - so we have overshoot. Note 
that the eigenvalues of this system are -1 and -2 and are both real . To see 
what the freedom in picking the initial condition of the integrator state 
(x^ here) can do for us, consider the eigenvectors of the A matrix associated 
with the above system: 


A 


0 1 
-2 -3 


*i 


.707 

-.707 


X 2 = “ 2 ; v 2 = 


-1 

2 
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1 

-1 


Thus, if we pick x Q ■ 

Another possibiliby would be to pick x Q 


, we have x(t) * x n and there is no overshoot. 


.5 

-1 


and we would see only the 


eigenvalue at -2, and thus a much faster response. 

From this simple example, it seems very likely that the freedom of choosing 
the integrator setpoint can have an impact on the resulting initial condition 
response. This subject will remain a topic for future research and will not 
be addressed any more in this report. It should be emphasized, however, that 
this type of overshoot with well-damped poles does not occur in the command 
response and is only important for determining the dynamic transient-response 
to changes in setpoint. 


5.2 A RESTRUCTURABLE FLIGHT CONTROL SYSTEM 

Now we are ready to put the whole system together. We link all the sub- 
systems together as shown in Fig. 5-3. The Failure Detection and Isolation 
(FDI) block determines when a failure has occurred and computes the new A and 
B matrices for the aircraft. Since here we are only concerned with actuator 
failures, only the B matrix will change. The automatic trim system block then 
determines the best operating point for the aircraft, based on the solution of 
the trim problem described in Section 3. This operating point is used by the 
dynamic compensator (as in Fig. 5-1). The control redesign block also uses 
the A,B matrices from the FDI block in order to compute the new gain matrix G 
which is used by the dynamic compensator. The Q and R matrices are parameters 
for the control redesign block and are computed from the redesign procedures 
described in Section 4. Under no uncertainty, Q and R remain the same and G 
is computed by solving the regulator problem with the new A and B matrices. 
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PILOT 



a-;834 


Figure 5-3. Complete Restructurable Control System 

The pilots commands go through a shaping filter before being introduced 
into the control loop. This is to both mix the pilot commands (if necessary) 
and to slow them down if necessary. They are mixed so that the pilot stick 
commands are interpreted correctly by the control system. They are filtered 
so that steps are not introduced into the control loops, thus reducing over- 
shoots and control saturation. A possible form for a preshaping filter is 
given in Fig. 5-4. Note that what the pilot controls is a deviation from the 
operating point which is determined by the trim problem. Thus, if undesir- 
able attitude coupling appears in the trim solution (e.g., side slip during a 
rudder failure which necessitates a de-crab maneuver before touchdown) it can 
be removed by the pilot through application of non-zero, constant r(t). 
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SPEED OF RATE 

RESPONSE LIMITER 



R-2835 


Figure 5-4. Example of a Shaping Filter for the i-th Control Channel 

Finally, the supervising block determines the flow and order of recon- 
figuration actions. This block must decide on a variety of issues which 
include: 

1. Sequencing and fading of trim and redesign solution application, 

2. Adequacy of trim solution and need to select a new operating 
point , 

3. Immediacy versus accuracy of trim solutions which require large 
numbers of iterations for convergence, 

4. Weightings and scalings of variables in the trim problem, 

5. The need for refinement of redesign and trim solutions based 
on more accurate FDI information, and 

6. Logical interfacing with the pilot through a flight-director. 
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SECTION 6 


APPLICATION TO A TRANSPORT CLASS AIRCRAFT (BOEING 737 MODEL) 

The automatic redesign procedure (presented in Section 4) and the auto- 
matic trim solution (presented in Section 3) will be demonstrated in this 
section on a linearized model of a modified Boeing 737 aircraft. The model 
is described in subsection 6.1. Subsection 6.2 develops the nominal state- 
feedback design for the unfailed aircraft, and subsections 6.3 and 6.4 present 
some linear analyses of the trim and redesign procedures. 

6.1 AIRCRAFT MODEL 

A linearized model of the modified NASA Boeing 737 aircraft operating at 
different flight conditions was supplied by NASA to ALPHATECH to demonstrate 
the automatic design procedure. Since the aircraft potentially has nine inde- 
pendent control surfaces, it is an ideal candidate for control restructuring. 
For this demonstration, an operating point with a flight angle (y) of -3 
degrees, pitch angle (0) of -.7 degrees, forward velocity (u) of 215 feet/sec, 
downward velocity (w) of 8.7 feet/sec, and altitude of 1500 ft was chosen. 

The flaps are set at 40 degrees. 

The linear aircraft model is in the form 

x a (t) = A a x a (t) + B a u a (t) (6-1) 

where x a (t) is a state vector of the linear aircraft dynamics and u a (t) is the 
vector of available control surfaces. The state vector is given by 
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u 


forward velocity, ft/sec 

w 


vertical velocity, ft/sec 

q 


pitch rate, rad/sec 

0 


pitch angle, rad 

V 


side velocity, ft/sec 

P 


roll rate, rad/sec 

r 


yaw rate, rad/sec 

4> 


roll angle, rad 

— — 


— __ 


(6-2) 


ThG NASA model included a ninth state for yaw angle which was eliminated 
since it will not be controlled by the regulation system. The longitudinal 
dynamics are decoupled from the lateral dynamics in the unfailed aircraft. 

The first four states represent the longitudinal dynamics and the second four 
represent the lateral dynamics. 

The input vector is given by 


u a = 


^LT 

left engine thrust, lbs 

5 rt 


right engine thrust, lbs 

5 ls 


left stabilator, deg 

5 rs 


right stabilator, deg 

6 r 

= 

rudder, deg 

6 le 


left elevator, deg 

6 re 


right elevator, deg 

^la 


left aileron, deg 

6 ra 


i 

right aileron, deg 


( 6 - 3 ) 
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The system 

matrix 

for this 

operating 

condition is 

given by 



""- 0.03735 

0.1055 

- 8.692 

- 32.17 

0.0 

0.0 

0.0 

0.0 


- 0.2763 

- 0.7054 

215.41 

0.4196 

0.0 

0.0 

0.0 

0.0 


- 0.0002007 

- 0.006228 - 0.5193 

- 0.0003222 

0.0 

0.0 

0.0 

0.0 


0.0 

0.0 

0.0 

1.0 

0.0 

0.0 

0.0 

0.0 


0.0 

0.0 

0.0 

0.0 

- 0.1451 

10.35 

- 214.5 

32.17 


0.0 

0.0 

0.0 

0.0 

- 0.01685 

- 1.529 

0.8053 

0.000003381 


0.0 

0.0 

0.0 

0.0 

0.003239 

-0.1212 

- 0.1458 

- 0.004113 


_ 0.0 

0.0 

0.0 

0.0 

0.0 

1.0 

-0.0120 

0.0 


The input matrix is given by 


(6-4) 


0.0003785 

0.0003785 

0.006813 

0.006813 

0.0 

0.003266 

0.0032660 

0.003647 

0.003647 ““ 

- 0.0000002952 

- 0.0000002952 

- 0.1688 

- 0.1688 

0.0 

- 0.08093 

- 0.08093 

- 0.09037 

- 0.09037 

0.000006263 

0.000006263 

- 0.0221 

- 0.0221 

0.0 

- 0.01059 

- 0.01059 

- 0.002849 

- 0.002849 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.1389 

0.0 

0.0 

0.0004774 

- 0.0004774 

0.000002128 

- 0.000002128 

0.007411 

- 0.007411 

0.009317 

0.003552 

- 0.003552 

0.008208 

- 0.008208 

0.00001245 

- 0.00001245 

0.0004336 

- 0.0004336 

- 0.0109 

0.0002637 

- 0.0002637 

0.0007019 

- 0.0007019 

_ 0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 

0.0 


The open-loop eigenvalues of the aircraft are: 


(6-5) 


Longitudinal 


Short Period: 
Phugoid: 


-0.614 ± 1 .5 j 
-0.0167 ± 0.17 j 


Lateral 


Dutch Roll: 
Spiral : 

Roll Subsidence: 


-.058 ± 1.106j 
-.0063 
-1.699 
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6 . 2 CONTROLLER DESIGN 

This subsection describes the design process followed to arrive at the 
final state-feedback controller • Since the longitudinal and lateral dynamics 
are decoupled for the unfailed aircraft, we can design them separately* To 
decouple the inputs, we need to mix them to obtain differential and collective 
inputs. We do this as follows* Let 


b mix 4 


— 0 

0 

1 

1 

0 

0 

0 

0 

0 ~ 

0 

0 

0 

0 

0 

1 

1 

0 

0 

1 

1 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

1 

0 

0 

0 

0 

1 

0 

0 

0 

0 

0 

0 

0 

0 

0 I 

0 

0 

1 

-1 

0 

0 

1 

-1 

0 1 

0 

0 

0 

0 

0 

0 

0 

0 

0 1 

1 

-1 

0 

0 

_ 1 

-1 

0 

0 

0 I 

0 

0 

0 

0 _ 


9x9 


( 6 - 6 ) 


SO 


where 


U NEW _ b MIX * u a 


u 


new 


5 CS 


collective stabilator \ 

6 ce 


collector elevator r 



> Longitudinal 

6 C t 


collective thrust 1 

6 ca 


collective aileron / 

6 r 


rudder \ 

6 da 


differential aileron i 

6 ds 


differential stabilator \ Lateral 

5 de 


differential elevator 1 

_ 6 dt _ 


differential thrust / 


(6-7) 
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We now need to scale the inputs according to their maximum values. Note that 
we cannot define absolute maximum limits for differential and collective 
inputs independently. However, as we are just using this to scale the inputs 
so things are weighted correctly, it is not as important. We pick the scaling 
for the new inputs as follows 

u p " ^1 ^ u new 

where 

S : 4 diag(lO, 20, 1000, 20, 20, 20, 10,20,1000) . (6-8) 

We then let 

Bl = B a (B MIX ) -1 Si (6-9) 

be our new B matrix, which is mixed and scaled. 

In order to make the state variables easier to work with, we would like 
to scale them so that 1 unit in each of the state variables is approximately 
equivalent in terms of importance. If we choose 

x p - Ti • x a (6-10) 

where 

T L = diag(0. 01, 0.01, 1,1, 0.01,1,1,1) (6-11) 

then our new system matrices are 

A p - T l • A a • Ti"! (6-12) 

B p = ?! • B X (6-13) 

and the linear aircraft model becomes 

= ^p "** ^p u p * 
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We can now split the aircraft model into a longitudinal model and a 
lateral model, and devise an LQ design for each of these. 

6.2.1 Lateral Design 

The lateral model is given by 


-0.1451 

0.1035 

-2.1450 

0.3216 

-1.6853 

-1.5292 

0.8053 

0.0000 

0.3239 

-0.1212 

-0.1458 

-0.0041 

0.0000 

1.0000 

-0.0120 

0.0000 


b LAT “ 


0.0278 

0.0001 

0.0000 

0.0000 

0.0000 

0.1863 

0.1642 

0.0741 

0.0710 

0.0021 

-0.2180 

0.0140 

0.0043 

0.0053 

0.0124 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

scaled 

versions of 

the lateral states, 

viz . , 


v/ 100 
P 


side velocity, ft/sec 
roll rate, rad/sec 

yaw rate, rad/sec 

roll angle, rad 


and the scaled inputs are 


<Sr/ 20 

5 DA /20 

5 ds /10 

6 D e/ 20 

6dt/1000 
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One of the goals we would like to achieve in the lateral axis is auto- 
matically coordinated flight. One way to achieve this approximately is to 
control side-velocity and bank angle. Thus, a nonzero commanded bank angle 
with a zero-commanded side velocity would produce a steady turn, with only a 
small residual side acceleration that the pilot can eliminate with the side 
velocity controls (rudder pedals). This also allows for coordinated turns 
with failures, without the pilot having to worry about the coordination of 
the turn. 

Thus, we decide to control side velocity, v, and bank angle, <|>. To 
eliminate steady-state errors, we put integrators on those states. Let 


C LAT 


10 0 0 
0 0 0 1 


so that 


y = 



C LAT x 


( 6 - 18 ) 


( 6 - 19 ) 


Our new augmented plant is given by 


or 



a lat 0 ~| 


X 


b lat 




+ 


_ C LAT 0 J 


_ X I J 


0 


( 6 - 20 ) 


z = Az + Bu 


( 6 - 21 ) 


Our first trial was 

R = I 
Q = I . 
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The resulting closed-loop eigenvalues are 


-0.377 ± 1 .200 j 

-1.7058 


-0.435 ± 0 .269 j 

-0.139 


These closed-loop eigenvalues are too lightly damped. So, in order to increase 
the damping, we increased the weighting on the roll rate. In addition, in 
order to raise the integrator action somewhat, we increased the weights on the 
two integrator states. We finally settled on 

R = I (6-22) 


Qlat - 


3 0 
0 20 
0 0 
0 0 
0 0 
0 0 


0 

0 

1 

0 

0 

0 


0 0 0 
0 


0 0 
0 0 
1 0 


0 

0 


0 40 0 

0 0 40 


which produced closed-loop eigenvalues of 


-0.855 ± 1.50j 
-.616 ± 0 .504 j 
-1.877 
-1.104 


(6-23) 


and a state-feedback gain matrix of 
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~ 8.0152 

-0.8558 

-12.6637 

-2.8876 

5.9409 

-2.1514 ~ 


-2.6946 

5.1579 

5.5219 

10.3317 

1.8254 

5.0554 

G LT " 

-1.1336 

2.2747 

2.3427 

4.5473 

0.8477 

2.2211 


-1.1340 

2.2109 

2.3305 

4.4249 

0.7986 

2.1638 


_-0.5543 

0.4002 

1.0030 

0.8584 

-0.1300 

0.4463 


By examining the individual elements of G^, we can determine that the control 
gains are not too large and are quite acceptable. Remember that the inputs 
and states have been scaled. 

The singular values of the scaled loop transfer function for this final 
design are given in Fig. 6-1. The dominant contributing inputs to each loop 
are shown on the plot, as determined by examining the left singular vectors. 
The loop transfer function crossover frequency of about 3 rad/sec provides 
sufficient bandwidth for command following and adequate stability margins. 
Figure 6-2 shows the singular values of the loop broken at the error signal 
for command following (x in Fig. 5-1). They look quite good and we expect 
the lateral subsystem to follow v and $ commands very well. Figure 6—3 shows 
the singular values of the closed-loop map from reference inputs to actual 
outputs. We expect it to follow commands well out to about 1 rad/sec, and do 
extremely well out to 0.1 rad/sec. 


6.2.2 Longitudinal Design 

The longitudinal model we have is given by 


— -0.0374 

0.1055 

-0.0869 

-0.3217 

-0.2763 

-0.7054 

2.1541 

0.0042 

-0.0201 

-0.6228 

-0.5193 

-0.0003 

_ 0.0000 

0.0000 

1.0000 

0.0000 


(6-25) 
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Figure 6-2. Singular Values of Lateral Loop at Error Signal 
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b lon 


with states 


x 


and inputs 


0.0007 
- 0.0169 
- 0.2210 
_ 0.0000 

u/ 100 
w/100 

q 

9 


0.0007 

- 0.0162 

- 0.2118 

0.0000 


0.0038 

0.0000 

0.0063 

0.0000 


0.0007 

- 0.0181 

- 0.0570 

0.0000 


forward velocity, 

ft/ sec 

downward velocity. 

ft/ sec 

pitch rate, 

rad/sec 

pitch angle, 

rad 


6 C s/10 


6 ce /20 
6ct/ 1000 
6 ca /20 


( 6 - 26 ) 


( 6 - 27 ) 


(6-28) 


At first, it was decided to control just pitch angle in the longitudinal 
axis* The pilot's thrust control would then be used as a setpoint for the 
control system, with the feedback system making adjustments to that setpoint* 
In order to control pitch angle with zero error in steady state, we 
augment the system with an integrator on pitch angle* Let 

c L0N = [ 0 0 0 1 ] (6-29) 

so that 

0 = c L0N x (6-30) 
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Then our new (augmented) system model becomes 


X 

. 

a lon 0 


X 


b lon 


■ z =» 




+ 


_ X I _ 


_ C L0N 0 _ 


_ X I _ 


_ 0 _ 


(6-31) 


or 


z 


Az + Bu 


We then proceed to design an LQ regulator for this augmented model. We used 

r LON = 1 (6-32) 

and tried several diagonal Q matrices. However, we could not get the eigen- 
values sufficiently far into the left-half plane to obtain satisfactory speeds 
of response, so we used the following trick. We let 

A x = A + al (6-33) 

for a = 0.1. We then solve the LQ problem for some Q 0 and Rq matrices using 
A x and B. This corresponds to solving the problem of minimizing 

J = j e^ at [ x^Qx + u^Ru ] d t . (6-34) 

0 

When the resulting state-feedback matrix G is used with the matrix A, we are 
guaranteed that 

RejAiCA-BG)} < - a , i = l,2,...,rtfp . (6-35) 
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equa- 


In order to be able to recalculate this G with the normal Rlccati 
tion, we note that the Rlccati equation for this problem is 


or 


0 =■ K[A+al] + [A+ol]T k + q 0 - kbr c -1bTk 
0 = KA + A t K + [Q 0 +2aK] - KBR 0 -1 b t K . 


Therefore, if we solve Eq. 6-36 for K, then Eq. 6-37 shows that the solution 
is identical to the standard solution with 


QlON = Qo + 2aK • (6-38) 

We have, as usual, G = -R 0 _1 BK. The computation of Qlqn in Eq* 6-38 is nec- 
essary for redesign purposes. We selected 


Qo 


0 2 0 0 0 

0 0 40 0 0 

0 0 0 6 0 

0 0 0 0 60 


(6-39) 


The heavy weighting on the pitch rate state tends to help damp those modes 
associated with it and the weighting on the integrator state brings the inte- 
grator action (as seen in the singular values) up to a suitable level. 

The singular values of the loop transfer function for this design are 
shown in Fig. 6-4. Note that the loop corresponding to thrust is quite low. 
This implies that those states which are regulated using collective thrust 
will not be regulated very well. By projecting the left singular vector cor- 
responding to this loop onto the space spanned by the columns of the G matrix 
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Figure 6-4. Singular Values of Longitudinal Loop at Input 
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for this design, we see that forward velocity is the dominant state being con- 
trolled at low frequencies for this loop. Thus, we would expect inadequate 
regulation of u from this design. This is shown in Fig. 6-5 which gives the 
scaled closed-loop response to a step in commanded pitch angle. 

While this design may be adequate for a pilot in the loop control systems, 
our present goal is to develop a control law which can be demonstrated auto- 
nomously on the NASA-Langley Research Center nonlinear simulation. Therefore, 
better regulation of forward velocity (u) is desired. Several designs which 
brought the thrust loop up to a higher level at low frequencies were examined. 
However, none were able to achieve good steady state regulation without severely 
reducing the robustness of the design to the highly significant throttle 
dynamics. For this reason, we added an integrator state corresponding to the 
integral of forward velocity. 

With this additional integrator, the augmented system model is given by 
Eq. 6-31 with 


C LON 


0 0 0 1 
10 0 0 


(6-40) 


Initially, we tried using the trick described by Eqs. 6-33 through 6-38 with, 

Qo = d iag[ 2 » 2 > 40, 6, 60, 2] (6-41) 

(which is the same as Eq. 6-39 with an additional weight for the integral of 
u state). This design produced good steady state regulation of u and good 
robustness to engine dynamics, but resulted in too much control action in <ScA‘ 
In order to keep the singular values of the scaled loop transfer function the 
same and shift the control action from 6 qa t0 ^CT* the diagonal element of the 
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Figure 6-5. Scaled Closed Loop Response to Pitch Angle Step Command 
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r LON corresponding to thrust was decreased by a factor of ten and the rows 
and columns of the Q matrix computed from Eq. 6-41 and Eqs. 6-33 through 6-38 
which correspond to weightings on u and Ju were also reduced by a factor of 
ten. The result is, 




R 

LON - dia S [ 1 » 1> •!» 

i] 


(6-42) 


~ 69.7531 

9.5838 

-3.1061 

-19.7252 

13.6632 

1.3749 ~ 



9.5838 

4.5549 

-1.6185 

-6.0149 

1.5320 

0.1662 


Qlon = 

-3.1061 

-1.6185 

46.2520 

11.1358 

5.3199 

-0.0729 

(6-43) 


-19.7252 

-6.0149 

11.1358 

46.2064 

16.8045 

-0.3857 



13.6632 

1.5320 

5.3199 

16.8045 

88.8258 

0.1769 



_ 1-3749 

0.1662 

-0.0729 

-0.3857 

0.1769 

0.6618 _ 


and 

— 1.3978 

1.4598 

-6.8311 

-11.6557 

-6.2575 

0.1939 ~ 



1.3388 

1.3988 

-6.5467 

-11.1701 

-5.9972 

0.1858 


g lon = 

27.9237 

3.8726 

1.4870 

-4.0887 

10.0066 

2.4249 

(6-44) 


__ -0.8064 

0.1156 

-1.6578 

-2.4716 

-1.9209 

-0.0407 _ 


The singular values 

of the scaled loop 

transfer 

function for this design are 

shown in Fig. 6-6. 

The design has adequate robustness to 

engine dynamics and 

improves the regulation of u 

during a 

pitch step 

as shown 

in Fig. 6-7. 

Of 


course, increased use of thrust is made during the pitch step of .1 radian. 

In fact, it requires about 8000 lbs. of collective thrust in the steady state 
to regulate forward velocity during this maneuver. This is deemed reasonable. 
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Figure 6-7. Closed Loop Response to Pitch Step (Scaled Quantities) 
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The closed loop eigenvalues are 


-1.17 ± .97 j 
-1.07 

(6-45) 

-.71 

-.10 ± . 02 j . 

Figure 6—8 shows the closed loop command following singular values. 

Based on this figure, velocity following is good to about .05 r/s and pitch 
angle following is good to about 2 r/s. 


6.2.3 Global Design 


We can now assemble the two subsystem designs into one global design. 
To do this, we simply set 


Aglob ~ 


a L0N 

0 



12x12 


(6-46) 


b glob 


b lon 0 
0 b lat _ 


12x9 


(6-47) 


where (Alqn» b L0n) the augmented longitudinal subsystem and (Alat» b LAt) * s 
the augmented lateral subsystem. We continue 


Qglob " 


Qlon 0 
0 Qlat J 


12x12 


(6-48) 


Rglob - 


r lon 0 
0 r lat _j 


9x9 


(6-49) 
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and we can solve one large Riccati equation to get the feedback gain 


G GLOB 


G LON 0 
0 G LAT 


9x12 


(6-50) 


where Glq N and Gl AT should equal the gains we calculated in the previous two 
subsections (6.2.1 and 6.2.2). 

We would like to convert our feedback gain back to the original inputs 
and states, so that it can be used on the full nonlinear simulation. Since 


x p = T 1 * x a (6-51) 

u p = S l _1 * b MIX * u a (6-52) 

and our regulator design minimizes 


oo 

J = / [ X P T Qglob x p + u p T RgLOB u p ]dt 


(6-53) 


for Xp and Up scaled. We could use 


and 


^ I [ x aug^ QF x aug u a RF u a 


where x aug T = (x a T , Cx a T ) 


(6-54) 


A F 


A a 0 
C 0 


12x12 


(6-55) 


B F 



12x9 


(6-56) 


83 


0 

0 

0 

1 


0 

0 

0 

0 


0 

0 

0 

0 


1 

0 

0 

0 


0 

1 

0 

0 


0 

0 

0 

0 


0 

0 

0 

0 


0 

0 

1 

0 


(6-57) 


so that 


and 


aug 


% x aug + u a 


(6-58) 


u 


= Cx- 


(6-59) 


We then define a larger scaling matrix 

T£ — diag ^ .01 , .01, 1, 1, 1, .01, • .01, 1, 1, 1, .01, 1 ^ (6—60) 

where we must scale the integrator states too, and a permutation matrix P 


P = 


1 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 


0 

1 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 


0 

0 

1 

0 

0 

0 

0 

0 

0 

0 

0 

0 


0 

0 

0 

1 

0 

0 

0 

0 

0 

0 

0 

0 


0 

0 

0 

0 

0 

0 

1 

0 

0 

0 

0 

0 


0 

0 

0 

0 

0 

0 

0 

1 

0 

0 

0 

0 


0 

0 

0 

0 

0 

0 

0 

0 

1 

0 

0 

0 


0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

0 

0 


0 

0 

0 

0 

1 

0 

0 

0 

0 

0 

0 

0 


0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

0 


0 

0 

0 

0 

0 
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0 
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0 

0 

0 

1 


0 

0 

0 

0 

0 

1 

0 

0 

0 

0 

0 

0 


12x12 


(6-61) 


in order to mix the integrator states back into the order we used for A^og. 
Then we use 

Qf = P T * T 2 T • QgloB • T 2 • P (6-62) 
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and 


R F 


( s l _1 b mix ) t 


• ^LOB * ( s l -1 * b MIx) 


(6-63) 


with the model (Eqs. 6-55 and 6-56) to obtain a state 
corresponds to the scaled design versions (i.e., same 
matrices are 


feedback matrix which 
physical feedback). The 


“ 1 . 1000D-06 

-9.0000D-07 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

0.00000+00 

0.00000+00 

0.00000+00 

-9 .0000D-07 

1 .1000 D- 06 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

0.00000+00 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

2.00000-02 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

0.00000+00 

0.00000+00 

0.00000+00 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

2.0000D-02 

O.OOOOIHOO 

O.OOOOIHOO 

0.00000+00 

O.OOOOIHOO 

0.00000+00 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

2 .5000D-03 

O.OOOOIHOO 

0.00000+00 

0.00000+00 

0.00000+00 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

5.00000-03 

0.00000+00 

0.00000+00 

0.00000+00 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

5.0000D-03 

0.00000+00 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

0 .OOOOIHOO 

O.OOOOIHOO 

5.00000-03 

O.OOOOIHOO 

__ O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

O.OOOOIHOO 

0.00000+00 

O.OOOOIHOO 

0.00000+00 

5.0000D-03 

(6-64) 


~ 6.9753D-03 

+.583*0-0* 

-3.1061 0-02 

-1.97250-01 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

l . 366 30—01 

0.00000+00 

0.00000+00 

1.37*90-0* 

9.S838D-0* 

4.55*90-0* 

-l .61850— 02 

-6.01490-02 

0.00000+00 

0.0000 0+00 

0.00000+00 

0.00000+00 

1.53200-02 

0.00000+00 

O.OOOOD+OO 

1.66 16D— 05 

-3 . 10610—02 

-1 .61850-02 

4.62560+01 

1.11360+01 

O.OOOOD+OO 

o.ooooo+oo 

0.00000+00 

0.00000+00 

5.31990+00 

0.00000+00 

0.00000+00 

-7.293*0-0* 

-1 .9725D-01 

-6.01*90-02 

1.11360+01 

4.6 2 060+01 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

1.6804 0+01 

O.OOOOD+OO 

O.OOOOIHOO 

-3.85710-03 

0.000017+00 

0.00000+00 

0.00000+00 

0.00000+00 

3.00000+0* 

0.00000+00 

0.00000+00 

0.00000+00 

O.OOOOD+OO 

0.00000+30 

O.OOOOD+OO 

0.00000+00 

0.00000+00 

0.00000+00 

0 . 00000+00 

0.00000+00 

0.00000+00 

2 .00000+01 

0.00000+00 

O.OOOOD+OO 

0.00000+30 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

1 .00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

O.OOOOIHOO 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

1.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

1 . 366 3D— 01 

1.53200-02 

5.31990+00 

1 .680*0+01 

0.00000+00 

0.00000+00 

0.00000+00 

0 .00000+00 

1.88260+01 

0.00000+00 

O.OOOOD+OO 

1 .7688D— 03 

0.00000+00 

0.00000+00 

0.00000+00 

O.OOOCO+OQ 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

4.00000-0) 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.00000+00 

0.0000 0+00 

0.00000+00 

0 .00000+00 

0.00000+00 

O.OOOOD+OO 

0.00000+00 

0.00000+00 

* .00000+01 

0.00000+00 

__ 1 .37490—04 

1 .86160-05 

-7.293*0-0* 

-3.85710-03 

0.0000 0+00 

0.00000+00 

0.00000+00 

O.OOOOD+OO 

1 .76880—03 

0.00000+00 

0.00000+00 

4.6181D-05 

(6-65) 

“ l.)96ir+02 

l .93580+01 

7.4*120+02 

-2.0*270+03 

-2.77130+00 

2.00100+02 

5.01510+02 

4.29190+02 

5.00390+0) 

-6 . 5 00 7 D— 01 

2.23170+02 

1.212*0+01 

1 .39610+02 

1.93580+01 

7.44120+02 

-2 .04270+03 

2.77130+00 

-2.00100+02 

-5.01510+02 

-4.29190+02 

5 . 0039D+0) 

6.50070-01 

-2 .23170+02 

1.21240+01 

7.00620-02 

7.30150-02 

-3.41560+01 

-5.82830+01 

-5. 66800-02 

1.13740+01 

1.171*0+01 

2.27370+01 

-3. 12820+01 

4.23850-02 

1.11060+01 

9.71140-03 

7 .00620—02 

7.30150-02 

-3.41560+01 

-5-82830+01 

5.66800-02 

-1.137*0+01 

-1.171*0+01 

-2.27370+31 

-3.12820+01 

-*.23850-02 

-1.11060+01 

9.7114D— 03 

1 .2+010-15 

2.90780-16 

-3.5417D-1* 

-5.26110-1* 

1.60300+00 

-1.71160+01 

-2 .53270+02 

-5.77520+01 

1 .09220-1* 

1 . 1 88 2 0+00 

-* .30270+01 

2.07200-16 

1. 33600-01 

1 . 398*0—01 

—6 .5*660+01 

-1.11690+02 

-1 .1340D-01 

2.21090+01 

2.33050+01 

*.*2*90+01 

- 5.99 800+01 

7.98580-02 

2.16380+01 

1.8555DH32 

1.33600-01 

1.39840-01 

— 6. 5466D+01 

-1.11690+02 

1.13*00-01 

-2.21090+01 

-2.330 5 0+01 

-*.*2490+01 

-5.99800+01 

-7.9850-02 

-2.16380+01 

1.65550—02 

-8.07080-02 

1.1551D— 02 

-1.65780+01 

-2.47140+01 

-2.6946D— 01 

5.15790+01 

5.52190+01 

1.03320+02 

•1.921 l D+01 

1.825*0-01 

5 .055*0+01 

-*.07150-0) 

_-8 .07080-02 

1. 15510-02 

-1.65780+01 

-2.471*0+01 

2.69460-01 

-5.15790+01 

-5.52190+01 

-l. 03320+02 

-1.92110+01 

-1.825*0-01 

-5.055*0+01 

-*.07510-0) 


(6-66) 


85 


These matrices can now be used with the original 

scaling and organization of 

inputs . 






Let 







G y _ [ G 4 g 5 g 8 g 1 ] 



(6-67) 


G r = [ g 2 g 3 g 6 g 7 ] 



(6-68) 


G I - [ g 9 g 10 g 11 

G 12 ] 



(6-69) 

where Gj is the ith column of 

Gp in Eq. 

6-66 . 

Then the equations of the compensator are: 






Xp = -r + Cx a - 

Cx D 



(6-70) 

c 

ii 

c 

o 

“ Gj-Xj. ”* GyCX a “f" GyCXQ 4“ 

G y r 

- G l x l (6-71) 

where 







0 0 0 1 0 

0 

0 

0 ~ 


C = 

0 0 0 0 1 

0 

0 

0 

(6-72) 


0 0 0 0 0 

0 

0 

1 



_ 1 0 0 0 0 

0 

0 

0 _ 



x r = G r x 

a 





~ 0 1 0 0 0 

0 

0 

0 ~ 


o 

n 

0 0 10 0 

0 

0 

0 

(6-73) 


0 0 0 0 0 

1 

0 

0 



_ 0 0 0 0 0 

0 

1 

0 _ 



and u Q and Xq are the desired setpoints. 
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6. 2. A Summary of Nominal Control Design 


A variety of linear simulations of the unfailed aircraft were performed. 
These included responses to command steps with and without wind gusts. For 
the gust simulations, the Dryden wind model [32] was used with a 1000 ft. tur- 
bulence scale length in the vertical and horizontal directions and a low rms 
velocity (a - 2 ft/s). 

Since these linear simulations resemble the nonlinear simulation results 
described in Section 7, we forego discussion of these results at this point. 

6.3 INVESTIGATION OF TRIM SOLUTIONS FOR STUCK FAILURES 

In this subsection, we provide some results of applying the quadratic 
programming algorithm described in Section 3 to the linear trim problem for a 
landing approach scenario. We assume, as usual, that sufficient information 
about the failure is made available from the FDI algorithm (see Fig. 5-3). 


Scenario Definition 

The normal (unfailed) operating point for a B-737 aircraft flying at 127 
knots, 1000 feet, and a -3 degree flight path angle is given by the nominal 
state vector, x n . 


x 


n 



215 ft/s 
8.7 ft/s 
0 r/s 
-.68 deg. 
0 f/s 
0 r/s 
0 r/s 
0 deg. 


velocity along the x-body axis 
velocity along the z-body axis 
angular velocity about y-body axis 
pitch angle 

velocity along the y-body axis 
angular velocity about x-body axis 
angular velocity about z-body axis 
roll angle (6-74) 
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and the nominal input vector 


> u n> 


u 


n 



4251 lbs 
4251 lbs 
**5.45 deg. 
-5.45 deg. 
0 deg . 
0 deg . 
0 deg . 
0 deg . 
0 deg . 


left engine thrust 
right engine thrust 
left stabilator deflection 
right stabilator deflection 
rudder deflection 
left elevator servo deflection 
right elevator servo deflection 
left aileron deflection 

right right aileron deflection (6—75) 


The above flight condition includes a 40 degree flap extension, no spoiler 
deflection and extended landing gear at a gross weight of 85,000 pounds. 

A linear model for the aircraft about this operating point is given by 
Eqs. 6-1 through 6-5. For this investigation, we will assume that the measur- 
able disturbance (w p in Eq. 3-6) which we wish to reject is caused by a stuck 
failure of a control element. That is, the disturbance w p , in each of the 
cases we will examine takes the form 


Wp - Adi b i (6-76) 

where Ad 4 is the difference between the stuck value of the i’th control element 
and its nominal value, and b^ is the i'th column of the B matrix in Eq. 6-1. 

Regulated Variables 

As demonstrated in [18], the choice of important quantities, y, for trim 
regulation greatly impacts the resulting solution. When y = x, for example, 
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the linear trim problem results In a balancing of the force and moment distur- 
bances by forces and moments applied by the control elements alone. While 
this result may satisfactorily reject the disturbances, the amount of remaining 
control authority available for use in controlling the airplane is substan- 
tially smaller than when other choices of y are made. 

For the current demonstration, our choice of y is motivated by two 
factors. First a landing approach scenario, the primary objective should be 
to maintain the desired approach flight path angle (in this case -3 degrees). 

If this objective is met, and the aircraft can achieve it in a steady state 
condition (i.e., x=0) then runway intercept can be achieved as long as the 
pilot/control-system has sufficient remaining control authority to establish/ 
re-establish the desired altitude and heading. Note that, while one might 
specify heading angle as a desired regulated variable, the trim solution will 
not achieve the desired heading on its own. This is due to the fact that, 
while the trim problem guarantees that its solution is an equilibrium point 
for the system (Eq. 6-1), it does not guarantee that application of the re- 
sulting nominal control values will achieve the solution unless the system is 
strictly stable. Since heading angle appears as an integrator state in the 
open loop aircraft, it can only be chosen as a regulated quantity if a heading 
loop is present in the control system. Also, the solution to the trim problem 
(if feasible) guarantees that the linear system used to approximate the air- 
craft is in steady state. To insure that the true aircraft is in steady 
state, the nonlinear equations of motion must be examined. The kinematic 

equations relating angular rates to Euler angles (e.g., see [33]), suggest 

• « 

that we can achieve constant Euler angles (e.g., 0 = <J> = 0) by requiring that 
all angular rates equal zero (i.e., P « Q = R = 0) . If the linear model used 
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in solving the trim problem corresponds to zero nominal angular rates, then we 
will achieve steady state flight by requiring the angular rate perturbations to 
be zero. 

For the results that follow, y^ = (y,q,p,r), where y represents perturba- 
tions to the desired (nominal) flight path angle, and p,q,r represent pertur- 
bations to the desired (nominal) angular rates. As in [18], the flight path 
angle, y, is nonlinearly related to the states in Eq. 6-74. The C matrix 
needed in Eq. 3-7 is, therefore, composed of the linear coefficients of the 
Taylor expansion for this relationship. As shown in [18], we have 


.00019 -.00465 0 1 

0 0 10 

0 0 0 0 

0 0 0 0 


0 0 0 0 
0 0 0 0 
0 10 0 
0 0 10 


(6-77) 


Note that in the above, the constraint q = 0 is redundant for this linear 
trim problem since at this operating point (Eqs. 6-74 and 6-75) 0 = q. Thus 
q = 0 is already specified by the linear trim problem by the requirement x = 0. 


Constraints 

In order to make the solution to the linear trim problem reasonable, we 
must constrain the states and controls to the linear and realizable region 
of the model in Eq. 6-1. First, we assume that the absolute limits on each 
control are given by 

S LT , 5 RT e [1600, 17,000] lbs 
6 LS» 5 RS e [~ 1A > 3 ] degrees 

6r e [-10, 10] degrees (6-78) 

5 LE» 5 RE e [ - 1°> 10] degrees 
6 LA» 6 RA e [“10, 10 ] degrees 
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Furthermore, we would like to leave about 5 degreees of control authority 
for each control surface so that these controls do not saturate when used 
dynamically. 

The linear region in state space is determined by a number of factors. 

1. For nonviscous flows such as those encountered in most aircraft, 
the lift and drag forces caused by control surface deflection 

is approximately proportional to dynamic pressure or, equiva- 
lently, to total velocity squared. Thus, each B matrix element 
can be written 

Bij = BijV 2 = Bij(V n +v) 2 (6-79) 

where V n is the nominal total velocity and v is the perturba- 
tion to V n . For an allowable error of 20 percent in the B 
matrix we must require that 

Bij(V n +v) 2 - j v n 2 < .2e i:j V n 2 (6-80) 

For v << 2V n , Eq. 6-80 is true for |v| < .lV n or about 
20 ft/sec. 

2. For the flight path angle linearization (represented by C 

in Eq. 6-77) to be valid, perturbations to V x and V z must be 
limited. If we plot values of true y versus linear predicted 
y for various combinations of V z and V x , we see that the error 
in Y can be limited to. 5 degrees by requiring perturbations to 
V x to be smaller than 20 ft/sec., and perturbations to V z to 
lie about within the range [-30, 20] ft/sec. Of course, if we 
limit the angle of attack to a presumably linear range of 0 
to 10 degrees, the constraint on perturbations to V z becomes 
roughly [-8.7, 20] ft/sec. 

3. Assuming a linear envelope of plus and minus 5 degrees sideslip 
angle, the side velocity perturbation limits are roughly plus 
and minus 19 ft/sec. (based on a maximum velocity magnitude of 
V n + v = 215 + 20 = 225 ft/sec.). 

4. For a landing approach, the attitude of the aircraft must be 
such that the pilot can see the runway, and a safe landing 
achieved. This implies that 9 be within the range of about 
plus and minus 10 degrees and <J> be within about ±5 degrees. 

5. Since we will be minimizing perturbations to P, Q, and R, limits 
on these values are arbitrary. In the algorithm definition, 

we will use limits of [-it, tt] radians/sec. which will never be 
active. However, in cases where P, Q, and R are not regulated, 
we might require |P| <3 deg/s and |q|,|r| < 15 deg/s. 
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Results 


One of the most Important factors in obtaining a fast and meaningful solu- 
tion to the linear trim problem is the scaling of the solution variables. As 
mentioned in [18], we can reflect the relative importance of the various ele- 
ments in x and u by choosing a diagonal weighting or scaling matrix S such that 

z = S“^z 

where z is the vector of states and controls given by z T = (x T ,u T ). Referring 
to the quadratic programming problem (Eq . 3-14), the new (scaled) cost J 2 becomes 

J 2 = (FS z - d) T (FS z - d) (6-81) 

and the solution, z is given by z = Sz. The objective will be the Euclidean 
norm of z, and the constraints on z are S~^zl < z" < S~^Z|j. 

The use of the scaling matrix S as detailed above implies that variables 
which have large scale factors tend to be used more in the final solution. 

For the purposes of this investigation, a reasonable choice of scale factors 
result when the remaining "authority" of each variable is used as its scaling. 
That is, if the limit on is symmetric about zero and equal to z^i , then S-^ 
s set equal to • This will mean that variables whose nominal values are 
far from their limits will be used more in achieving the minimum norm solution. 
Also, this scaling implies that the scaled limits on zj are -1 < <1. 

Summarizing, the parameters of the quadratic programming algorithm (Eq . 

3-14) for this investigation, we have, 

2 L T = (-20, -8. 7, -3, -0.20, -19, -3, -3, -.09, -2650, (6-82) 

-2650, -3. 5, -3. 5, -5, -8, -8, -5, -5) 

Z U T = (20,20,3, .20, 19, 3, 3,. 09, 7750, 7750, 3. 5, (6-83) 

3. 5, 5, 2, 2, 5, 5) 
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S * diag 


(6-84) 



(i.e., S is a diagonal matrix with the values of z^ given in Eq. 6-83 along 
i ts diagonal) 


F 


A B 
C 0 


(6-85) 


d = 



( 6 - 86 ) 


Table 6-1 presents the linear trim solutions for disturbances, w, corre- 
sponding to single stuck or frozen control elements at non-zero positions (as 
in Eq. 6-76) . 

The engine failure (first column in the table) corresponds to a total 
loss of thrust. In this case, the failure is compensated by applying a large 
thrust to the remaining engine and then compensating for the remaining imbal- 
ances by a combination of surface deflections and state perturbations. The 
resulting flight-path angle can be computed by applying the perturbations of 
V x , V 2 and 0 to the nominal values in Eq. 6-74 and 6-75 and computing the 
resulting value of y = 0 - arctan(V z /V x ) = -3.5 degrees. Note that the total 
Vy and values are nonzero indicating that the aircraft is using a sideslip 
configuration to reject some of the lateral disturbances. This effect, and 
the use of nonzero perturbations of V x , V 2 , and 0, we will call "attitude 

coupling." The use of attitude coupling in the trim solution allows the air- 

. 

craft to achieve the desired condition (x=0, y=y c j) with smaller values of sur- 
face deflection as compared to the case where forces and moments are balanced 
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TABLE 6-1. QP SOLUTIONS FOR VARIOUS FAILURES 


SOLUTION 

FAILURE 

LEFT 
ENGINE 
-4251 LBS 

LEFT 

STABILATOR 
-8 DEG 

RUDDER 
10 DEG 

LEFT 
ELEVATOR 
-12 DEG 

LEFT 
AILERON 
10 DEG 

STATE PERTURBATIONS: 






V x 

(f/s) 

-20 

-20 

2.9 

-4.9 

.08 

v z 

(f/s) 

8.0 

7.9 

-1.2 

2.0 

-1.0 

Q 

(r/s) 

0 

0 

0 

0 

0 

0 

(r/s) 

.036 

.041 

-.006 

.01 

-.005 

v y 

(f/s) 

6.3 

-5.4 

11 

-2.7 

5.4 

P 

(r/s) 

0 

0 

0 

0 

0 

R 

(r/s) 

0 

0 

0 

0 

0 

4> 

(r) 

.049 

-.018 

.006 

-.009 

.017 

CONTROL PERTURBATIONS: 






LT 

(lbs) 

0 

-150 

2750 

24 

-336 

RT 

(lbs) 

| 3113 

-580 

-2650 

-200 

130 

LS 

(deg) 

3.5 

0 

1.6 

2.5 

-.69 

RS 

(deg) 

-3.0 

3.5 

-1.2 

2.3 

-.32 

R 

(deg) 

-5.0 

-1 . 5 

0 

-.81 

1.7 

LE 

(deg) 

2.0 

1.7 

.26 

0 

-.11 

RE 

(deg) 

-8.0 

1.6 

-.20 

.36 

-.05 

LA 

(deg) 

5.0 

2.95 

3.3 

.80 

0 

RA 

(deg) 

-5.0 

2.1 

-3.8 

.37 

.28 

NUMBER OF ITERATIONS 
FOR CONVERGENCE: 

10 

3 

2 

1 

1 
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by the control surfaces alone (i.e., forcing all states to remain unperturbed 
and solving for a minimum J 2 = 8Bu + wl). The use of attitude coupling is 
particularly pronounced in the rudder failure case where a sideslip angle of 
about 3 degrees results, and in the engine failure case where a bank angle of 
2.8 degrees is maintained. 

The effect of scaling is demonstrated by comparing Table 6-1 with Table 

6-2. In Table 6-2 the same failure cases are used, but the scaling matrix S 

is set equal to the Identity (i.e., no scaling). For the rudder and engine 
failures, two effects are clearly discernible. First, with no scaling (Table 
6-2), the tendency is to use considerably more control-surface and attitude- 
coupling perturbations with less thrust perturbations. This might be expected 
since the scaled results (Table 6-1) put a smaller price on the use of thrust 
perturbations. Also, in these two cases, several variables are at their 
limits, and as a result, the number of iterations needed to find these solu- 
tions is substantially greater than those in Table 6-1. In the other failure 
cases, substantially smaller thrust perturbations appear as compared to Table 
6-1, but the control surface and attitude coupling perturbations are not 
affected as greatly as in the case of rudder and engine failures. 

The above solutions provide some idea of the capabilities of the linear 

trim algorithm for some fairly severe failure situations. In all cases 

defined above, the feasible solution provided perfect disturbance rejection 
capabilities (in the sense that Fz - d = 0 in Eq. 3-14). One of the issues 
raised in early assessments of the res tructurable control problem (e.g., see 
[34]), was how the use of various nonstandard control surfaces would impact 
the ability to recover a stable flight condition following a major failure. 

The above results suggest that sufficient control authority among the normal 
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TABLE 6-2. QP SOLUTIONS FOR VARIOUS FAILURES - NO SCALING 


SOLUTION 

FAILURE 

LEFT 
ENGINE 
-4251 LBS 

LEFT 

STABILATOR 
-8 DEG 

RUDDER 
10 DEG 

LEFT 

ELEVATOR 
-12 DEG 

LEFT 
AILERON 
10 DEG 

STATE PERTURBATIONS: 






V x 

(f/s) 

-20 

-12.9 

-20 

.07 

5.3 

v z 

(f/s) 

5.5 

4.4 

8.4 

-.03 

-3.1 

Q 

(r/s) 

-.006 

0 

0 

0 

0 

0 

(r) 

.017 

.02 

.04 

-.0002 

-.01 

v y 

(f/s) 

1.9 

-6.3 

15.8 

-1.3 

3.9 

P 

(r/s) 

-.002 

0 

0 

0 

0 

R 

(r/s) 

-.0002 

0 

0 

0 

0 

♦ 

(r) 

.03 

-.018 

.03 

-.004 

.01 

CONTROL PERTURBATIONS: 






LT 

(lbs) 

0 

-30 

1510 

-.01 

-.21 

RT 

(lbs) 

2030 

-30 

-2140 

-.01 

-.2 

LS 

(deg) 

3.5 

0 

3.5 

3.5 

-2.6 

RS 

(deg) 

-3.5 

3.5 

-3.0 

1.8 

2.4 

R 

(deg) 

-5.0 

-2.3 

0 

-.5 

1.6 

LE 

(deg) 

1.6 

2.0 

2.0 

0 

-1.2 

RE 

(deg) 

-8.0 

2.0 

-8.0 

.87 

1.2 

LA 

(deg) 

5.0 

5.0 

5.0 

.99 

0 

RA 

(deg) 

5.0 

5.0 

-5.0 

-.93 

-1.6 

NUMBER OF ITERATIONS 
FOR CONVERGENCE: 

>30 

6 

9 

2 

1 
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control elements seems to be available for rejecting the disturbances caused 
by any single stuck or frozen control element failure. Therefore, the only 
impact of using nonstandard control elements in the failure cases we have 
examined would be in increasing the amount of remaining control authority of 
the primary surfaces while maintaining the desired disturbance rejection capa- 
bilities. We now demonstrate this effect by including the use of spoilers in 
conjunction with the other surfaces in solving the trim problem. 

Three issues which must be addressed before adding spoilers as a control 
element in the trim problem are: (1) the nominal deflection value (about 

which minimum perturbations will be sought), (2) the scale factor or weight 
which will be used, and (3) the linear range of spoiler deflection. 

While some advantage to using nonzero nominal spoiler deflections in the 
trim problem exist (e.g., the ease with which these surfaces might be included 
in a redesigned control system), such use is likely to result in spoiler de- 
ployment upon a false failure alarm. While this may not be a major drawback, 
it would increase the burden on any executive control logic system for deter- 
mining when spoiler deployment is desirable. Therefore, in the results that 
follow, we will assume a nominal value of zero spoiler angle in which, if 
there are no disturbances to reject, all of the unfailed nominal deflections 
will be maintained. 

In order to insure that the spoilers are used when a failure does exist, 
their use must be made cheap by proper choice of their corresponding scale 
factors. For example, we can guarantee that a full spoiler deflection (of say 
10 degrees) is used before, say, 0.5 degrees of another surface (if they would 
produce the same disturbance rejection capabilities) by making the ratio of 
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their scale factors 200:1. For example, a scale factor of 5 on other surfaces 
gives a desired spoiler scale factor 1000 degrees. Finally, to maintain model 
accuracy, we must limit spoiler deflection to the range [0,8] degrees. 


The augmented B 

matrix 

for 

the results 

that 

follow 

is 




“ 0 . 38 E -03 

0 . 38 E -03 

0.0068 

0.0068 

0.0000 

0.0032 

0.0032 

0.0036 

0.0036 

- 0.0164 

- 0.0164 “ 


- 0 . 29 E -06 

- 0 . 29 E -06 

- 0.1688 

- 0.1688 

0.0000 

- 0.0809 

- 0.0809 

- 0.0904 

- 0.0904 

0.1733 

0.1733 


0 . 63 E -05 

0 . 63 E -05 

- 0.0221 

- 0.0221 

0.0000 

- 0.0106 

- 0.0106 

- 0.0028 

- 0.0028 

0.0021 

0.0021 


0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 


0.0000 

0.0000 

0.0000 

0.0000 

0.1389 

0.0000 

0.0000 

0.0005 

- 0.0005 

0.0262 

- 0.0262 


0 . 21 E -05 

- 0 . 21 E -05 

0.0074 

- 0.0074 

0.0093 

0.0036 

- 0.0036 

0.0082 

- 0.0082 

- 0.0197 

0.0197 


0 . 12 E -04 

- 0 . 12 E -04 

0.0004 

- 0.0004 

- 0.0109 

0.0003 

- 0.0003 

0.0007 

- 0.0007 

- 0.0026 

0.0026 


_ 0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 

0.0000 


(6-87) 

where the last two columns correspond to the estimated spoiler effectiveness. 

Table 6-3 summarizes the result of applying the quadratic programming 
algorithm with the spoiler-augmented B matrix to the linear trim problem for 
the failure cases used in the previous discussion. Comparing Tables 6-1 and 
6-3, we see that in the case of engine, rudder and aileron failures, the use 
of spoilers, as expected, reduces the amount that the primary control surfaces 
must contribute to the trim solution. 

Summary 

The results presented in this section demonstrate the operation of a 
quadratic programming algorithm in the solution of the linear trim problem 
for several failure cases of interest. The importance of scaling the solution 
variables was demonstrated and it was seen that: (1) the amount of control 

usage of one element relative to other elements (and the relative amount of 
attitude coupling) could be modified by proper choice of scale factors, and 
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TABLE 6-3. QP SOLUTIONS FOR VARIOUS FAILURES - WITH SPOILER DEFLECTIONS 


SOLUTION 

FAILURE 

LEFT 
ENGINE 
-4251 LBS 

LEFT 

STABILATOR 
-8 DEG 

RUDDER 
10 DEG 

LEFT 
ELEVATOR 
-12 DEG 

LEFT 
AILERON 
10 DEG 

STATE PERTURBATIONS: 






v x 

(f/s) 

-6.9 

-20 

1.33 

-4.8 

.92 

v z 

(f/s) 

4.6 

7.9 

1.29 

2.07 

-.01 

Q 

(deg/s) 

0 

0 

0 

0 

0 

0 

(deg) 

1.3 

2.3 

.32 

.60 

-.01 

v y 

(f/s) 

9.25 

-5.4 

15.6 

-1.9 

.36 

p 

(deg/s) 

0 

0 

0 

0 

0 

R 

(deg/s) 

0 

0 

0 

0 

0 

♦ 

(deg) 

3.93 

-1.02 

1.9 

-.34 

-.06 

CONTROL PERTURBATIONS: 






LT 

(lbs) 

0 

-148 

1815 

9.6 

129 

RT 

(lbs) 

4558 

- 577 

-1222 

-140 

119 

LS 

(deg) 

.80 

0 

.31 

2.51 

-.30 

RS 

(deg) 

-1.3 

3.50 

.18 

2.39 

-.30 

R 

(deg) 

-5.0 

-1.51 

0 

-.52 

-.13 

LE 

(deg) 

.14 

1.69 

.05 

0 

-.05 

RE 

(deg) 

-.23 

1.63 

.02 

.37 

-.05 

LA 

(deg) 

3.6 

2.95 

.35 

•74 

0 

RA 

(deg) 

-2.0 

2.10 

-.12 

.44 

-.05 

LSP 

(deg 

0 

0 

0 

0 

4.90 

RSP 

(deg) 

8.0 

] 

0 

8.0 

.65 

1.08 

NUMBER OF ITERATIONS 
FOR CONVERGENCE: 

20 j 

3 

5 

2 

3 
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(2) the number of Iterations needed to obtain a solution is greatly influenced 
by the particular choice of scale factors. In addition, the use of nonstan- 
dard control elements was demonstrated by considering the addition of spoiler 
control elements. In most cases, the addition of spoilers caused the resulting 
solution to achieve the desired flight condition with smaller values of nominal 
primary control surface perturbations. 

6. A LINEAR ANALYSIS OF CONTROL LAWS FOR STUCK FAILURES 

In this subsection we present a brief summary of the results of an exten- 
sive linear analysis of the control redesign procedure. The matrix of test 
cases is shown in Table 6-4. For each test case, the closed-loop eigenvalues 
were determined, the singular values of the loop transfer function (LTF) were 
plotted versus frequency, a linear simulation of the aircraft response to 
wind gusts was performed, step responses to stabilator and engine failures 
were examined, and, in the correct redesign cases (4xx), the initial condi- 
tion response to a particular trim solution was found. In addition, wind 
gust responses for the no-failure case were found. Note that in these trials 
using the redesigned control law when there is no failure, is identical to the 
case when there is a failure and it is correctly identified. The simulations 
are all based on a linear rigid body approximation to the aircraft dynamics. 

No actuator dynamics and no travel limits are imposed, however, in most cases, 
the control surfaces remain within their saturation limits. Some character- 
istic results are presented below. 
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TABLE 6-4 • MATRIX OF TEST CASES WITH MNEMONICS 




NO 

REDESIGN 

CORRECT 

REDESIGN 

INCORRECT 

REDESIGN 

INCORRECT 

REDESIGN 


LT 


3LT 

4LT 




LS 


3LS 

4LS 

5LS/LE 



R 


3R 

4R 

5R/LA 



LE 


3LE 

4LE 

5LE/RE 

5LE/LS 


LA 


3LA 

4LA 

5LA/R 



LA & RA 


3LARA 

4 LARA 




LS & RS 


3LSRS 

4LSRS 




LS & LE 


3LSLE 

4LSLE 








1 




Key : R/LT = Right/Left Engine 

R/LS = Right/Left Stabilizer 
R = Rudder 

R/LE = Right/Left Elevator 
R/LA « Right/Left Aileron 


3XX = No Redesign Cases 

4xx - Correct Redesign Cases 

5xx = In Correct Redesign Cases 
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Table 6-5 provides the eigenvalues (listed In order of decreasing real 
part) for some of the no redesign and correct redesign cases (3xx and Axx). 
Note that no distinction between lateral and longitudinal modes is made in the 
table since the aircraft does not, In general, decouple when a failure occurs. 
For comparison, the open loop eigenvalues (including the 4 integrator states) 
are: 


Longitudinal Modes 


-.61 ± 

1.5j (short period) 

-.017 ± 

.17 (phugoid) 

0.0 

(integrator) 

0.0 

(integrator) 


and the closed loop eigenvalues 
Longitudinal Modes 
-1.2 ± .97 j 


Lateral Modes 


-1.7 

(roll subsidence) 

-.058 ± 

l.lj (dutch roll) 

-.0063 

(spiral) 

0.0 

(integrator) 

0.0 

(integrator) 


for the baseline design are 
Lateral Modes 
-1.9 


( 6 - 88 ) 


"i-l -1.1 (6-89) 

-•71 -.86 ± 1 .5 j 

-.10 ± .023 j -.62 ± . 50 j 

In Table 6-5, a * denotes eigenvalues which are significantly different with 
the redesigned control law as compared to the nominal control law when the 
corresponding failure is present. 

The most striking result is for the rudder failure (test cases 3R and 4R) . 
With no redesign, one eigenvalue appears at -.007 r/s. Although this is close 
to the open loop spiral mode, the eigenvector associated with this mode is 
actually comprised mostly of the side velocity integrator state. The rede- 
signed control law moves this mode to -.16 r/s which is presumably superior. 
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TABLE 6-5. CLOSED LOOP EIGENVALUES FOR TEST CASES (3XX) AND (4XX) 


3LT 

4LT 


3LS 

4LS 


3R 

4R 

-1.9 

-1.9 


-1.9 

-1.9 


-1.9 

-1.9 

-1.2 ± .97 J 

-1.2 t .97 J 


- 1.1 

- 1.1 


-1.2 t .97 J 

-1.2 t • 97 J 

- 1.1 

- 1.1 


- 1.1 * l . 2 j 

-1.1 * 1.1J 


- 1.1 

- 1.1 

- 1.1 

- 1.1 


-.85 ± 1.5J 

-.86 ± 1 .5 J 


-.71 

-.71 

-.86 t 1.5J 

-.86 t 1 .5 J 


-.65 i .36 j 

-.78 t .14 j* 


-.47 ± .54 J 

-.50 ± .55 j 

-.72 

-.71 

1 

-.56 ± ,46 j 

-.62 i .48 j* 


-.13 t 1.1J 

-.18 t l.lj 

-.62 ± .5 J 

-.62 ± 0.5 j 


-.1 ± .02 j 

| 

-.1 t .02 j 


-.10 i .02 j 

-.16* 

-.082 

-.085 


1 

| 



-.007 

-.10 ± .02 j 

-.065 

-.066 




i 
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The wind gust response for these (rudder failure) cases shows slightly better 
regulation of bank angle with the redesigned control law, although in both 
designs, the oscillations are not desirable and much larger than the gust 
response of the unfailed aircraft with the nominal control law. This is shown 
In Figs. 6-9 through 6—11. Although the bank angle appears divergent in Figs. 
6-10 and 6-11, it is actually reasonably regulated when the simulation is run 
for longer time periods. With the redesigned control law, any improvement 
in regulation is accomplished through the increased use of differential ele- 
vators, stabilators and throttle. It appears that differential aileron is 
used in the same manner for both cases 3R and 4R. 

Table 6—6 shows the closed loop eigenvalues for several combinations of 
stuck failures. For the failure of both ailerons (test cases 3 LARA and 4 LARA) , 
the eigenvalue at -.84 ± .05j with no redesign becomes overdamped at -1.0 
and -.98 when the redesigned control law is implemented. In the other cases, 
underdamped modes with no redesign become better damped when the redesigned 
control law is used. In addition, it is interesting to note that in many 
cases, the redesigned eivenvalues revert back closer to the original baseline 
eigenvalues than do the non-redesigned eivenvalues. The wind gust responses 
for cases 3LSLE and 4LSLE show that better regulation of forward velocity (u) 
is achieved with the redesigned control law and that this is accomplished 
through the increased use of collective ailerons and throttle. Figures 6-12 
and 6-13 compare the velocity regulation performance of the nominal and rede- 
signed control law with stuck left stabilator and left elevator. 

The step response of the closed loop system to a hard-over failure is 
given by 

x = (A-BG)x + w (6-90) 
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where x is the perturbation of the state variables from their unfailed trim 
values, w is the step disturbance caused by a hard-over failure (see Eq. 6-76), 

B is the effectiveness matrix for the failed aircraft, and G is the feedback 
gain. Figures 6-14 and 6-15 compare the response to a failed throttle using 
the nominal feedback gain (no restructuring) and the feedback gain determined 
by the control resdesign procedure. Surprisingly, the aircraft seems to 
recover from the failure without saturation of any control element even with 
no control law redesign. The maximum angle of attack during this recovery is 
3.5 degrees and the maximum bank angle is about 1 degree. Forward velocity 
is reduced by about 8 fps before it begins to increase. With the redesigned 
control law, the most noticable effect is the slightly decreased use of rudder 
and aileron controls during recovery. 

The step response to a stabilator runaway (both stabilators hard-over to 
their negative limit) was also examined. In both the cases (redesign and no 
redesign) recovery is accomplished only by exceeding the saturation limits of 
the elevators. When the feedforward trim solution is applied for this case, 
recovery is accomplished without saturation of the elevators, however, the 
remaining throttle is initially retarded to zero thrust which, presumably, 
violates allowable operation. Further examination of these cases appears in 
Section 7, where they are simulated on a nonlinear aircraft model which includes 
the various surface travel and rate limits as well as actuator dynamics. 

Finally, Table 6-7 shows the closed loop eigenvalues for several misclas- 
sification cases. That is, the actual control effectiveness (B matrix) corre- 
sponds to one failure, but the control law redesign is implemented for another. 
The net effect of a misclassif ication is to remove both the surface which is 
failed and the surface which is identified as failed from use in the redesigned 
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control system. As a result, the eigenvalues in Table 6-6 tend to resemble 
the cases corresponding to a failure with no redesign. This is particularly 
evident for case 5R/LA where we see the integrator mode at -.008 r/s which is 
very close to the mode at -.007 for case 3R. 
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Figure 6-9. Gust Response for No Failure and Nominal Control Law 
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Figure 6-10. Gust Response for Rudder Failure with No Redesign 
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Figure 6-11. Gust Response for Rudder Failure with Redesigned Control Law 
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TABLE 6-6. CLOSED LOOP EIGENVALUES FOR COMBINED FAILURE TEST CASES 



TABLE 6-7. CLOSED LOOP EIGENVALUES FOR MISCLASSIFICATION CASES (5XX) 






5LA/R 

-1.8 

-1.9 

-1.9 


-1.8 

-1.1 

-1.1 

-1.1 

-1.2 ± .98 j 

-1.2 ♦ .99j 

-.96 ± 1 .3 j 

-.95 i 1 .3 j 

-.95 i 1 .3 j 

-1.0 

-1.0 

-.85 t 1.5J 

-.84 ± 1 .5 j 

-.84 i 1 .5 j 

-.72 

-.74 

-.58 * .46 j 

-.65 i .43 j 

-.65 i .43 j 

-.41 t .48 j 

-.33 t .50J 

-.57 t .37 j 

-.14 t .40 j 

-.43 t .40 j 

-.n ± i.ij 

-.15 ± l.lj 

-.10 * .02 j 

-.10 i .02 j 

! .10 ± .02 j 

-.10 t .02 j 

-.16 




-.008 

-.10 ± .02 j 
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SECTION 7 


SIMULATION RESULTS 

The performance of the res tructurable flight control system (RFCS) 
described in Section 5 was tested at the NASA Langley Research Center using 
that facility’s modified B-737 aircraft (batch) simulation. This simulation 
was chosen because of its extensive capabilities for simulating realistic 
responses (during normal and failed flight) of the B-737 aircraft. Models 
of this aircraft were used during this project for design and evaluation of 
the RFCS concept and it is anticipated that some limited flight tests on 
NASA’s Advanced Transport Operations (ATOPS) B-737 aircraft may be possible. 

A summary of the simulation’s capabilities and the test results is presented 
next. This is then followed by a more detailed description of the full test 
plan and a discussion of some of the more interesting results. 

7 . 1 SUMMARY 

The capabilities of the simulation which are relevant to this project 
are listed in Table 7-1. The simulation is based on the 6 degree of freedom 
equations of motion for a rigid body driven by aerodynamic, propulsive, and 
gravity forces. The aerodynamic model is nonlinear and, for this project, 
could not be altered. Full independent control authority is available and 
realistic actuator models including rate and travel limits are employed. The 
control system described in subsection 6.2 was implemented with the capability 
to change the control gains and the nominal "trim'* values at any preselected 
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TABLE 7-1. CAPABILITIES OF NASA’s MODIFIED B-737 SIMULATION 


6 DOF Rigid body Equations 

Nonlinear Aerodynamic Model 

Independent Control Authority 

Actuator Models (Rate and Travel Limits) 

Control System 

Command Generation 

Sensor Noise 

Wind Gusts 

Failures 


times during the simulation. All control redesign and trim calculations were 
made off-line for the selected failure cases. A command generator which pro- 
vided steps and ramps of commanded pitch angle, bank angle, sideslip, and 
longitudinal velocity was also made implemented. Finally, the simulation 
had the capability to simulate stuck (at last value) and hard-over (runaway) 
failures Including engine out conditions. 

There were three important general results that were observed. First, 
the nontraditional use of traditional control surfaces in a nominal feedback 
control system to spread control authority amongst many redundant (in terms 
of the forces and moments which can be produced) control elements provided 
a significant amount of fault tolerance without any use of restructuring 
techniques. In most single element failures, "recovery" was automatically 
achieved and little loss in command response performance was observed. A 
stuck rudder failure provided the most challenging single element failure 
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situation since it is used extensively for damping the dutch roll mode and 
since generation of side force is generally not possible with the other con- 
trol elements . 

Secondly, the use of new feedback gains (provided by the feedback control 
redesign procedure) following a failure, alone can provide significantly 
improved recovery as long as the control elements remain within their travel 
limits and as long as uncertainty about the failure identity is properly 
handled. This effect is particularly evident in the stuck rudder failure case. 
When control elements reach their travel limits during a failure, performance 
generally degrades as expected. In failure cases where the nominal control 
system performed well by itself, the application of redesigned feedback gains 
resulted in little, if any improvement. However, when a failure is misclassi- 
fied and feedback control redesign is based on the incorrect control element, 
potentially severe performance degradation can take place. By embedding FDI 
uncertainty in the redesign procedure, significantly better performance is 
achieved (over the misclassif ied failure case) although it is clear that cor- 
rect failure identification (and subsequent application of redesigned feedback 
gains) provides the best performance during failures. 

Finally, the use of the feedforward trim solution in conjunction with 
redesigned feedback gains, allows recovery to take place in most cases, even 
when significant control saturation occurs. This is generally due to the fact 
that any servo errors resulting from a failure are quickly reduced by appli- 
cation of the feedforward trim solution. Since the redesigned control system 
stabilizes the aircraft and the servo errors remain small due to the feed- 
forward trim, recovery is generally achieved even when many control elements 
reach and remain at their travel limits. 
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7.2 IMPLEMENTATION AND TEST PLAN DETAILS 


In all of the results to be subsequently presented, the following assump- 
tions were made. 

1. All simulation runs were begun In the nominal configuration 
defined in subsection 6.1. The nominal trim values (x 0 ,u 0 ) 
initially applied to the aircraft are given by Eqs. 6-74 
and 6-75. 

2. In order to handle windup of the integrator states during 
control saturation, Eqs. 6-70 and 6-71 are modified to: 


xi = G l (y - y 0 - r) (7-1) 

u = u 0 - G r x r - Gy(y - y D - r) - x x (7-2) 


Since there is, now, one integrator state per control element, 
when a particular control reaches its travel limit, the cor- 
responding integrator state is held at its last value until 
the corresponding control comes out of saturation. 

3. In most cases (except where noted in subsection 7.3) the 
travel limits on each control element are given by their 
allowable perturbations from trim and take the following 
values . 


Stabilator limits 
Elevator limits 
Aileron limits 
Rudder limits 
Spoiler limits 
Throttle limits 


(-9 to 8 degrees) 
(±20 degrees) 

(±10 degrees) 

(±10 degrees) 

(0 to 40 degrees) 
(-10 to 40 degrees) 


4. All applications of the redesign technique (except where 
noted) were implemented by setting the column of the B 
matrix defined in Eq . 6-5 corresponding to the failed 
control element equal to zero. 


5. Finally, the definitions and values used in solving the 
trim problem are (except where noted) given by Eqs. 6-82 
through 6-87. 
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The overall test plan was designed to demonstrate the ability of the 
aircraft to recover from a failure and follow subsequent commands under the 
following conditions • 

1. No redesign (nominal feedback system only), 

2. Gains only (application of redesigned feedback gains at the 
time of failure), 

3. Gains and Trim (application of redesigned feedback gains 
and feedforward trim values at the time of failure), 

4. FDI delay (application of gains and trim at seledcted times 
following a failure), 

5. FDI misclassif ication (application of redesigned control 
gains for an unfailed control at the time of failure and 
use of uncertainty in the redesign technique), 

6* Spoilers (use of spoilers in the solution of the trim problem 

and application of gains and trim values at the time of 
failure . 

Each of these "test cases" were examined for a variety of failure modes 
i ncluding : 

1. Individual stuck surfaces (left or right stabilator, elevator, 
aileron and rudder), 

2. Stabilator runaway (runaway up and runaway down), 

3 . Engine out , 

4. Combinations of stuck failures. 

In the next subsection, we present some of the more interesting results which 
provide substantiation for the conclusions drawn in subsection 7.1. 


7.3 DETAILED RESULTS 

For single element stuck failures (including the engine out failure), 
the nominal LQ control system performed quite well, both in terms of recovery 
and subsequent command following. 
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Figure 7-1 shows the command responses for a bank-sideslip-pitch maneuver 
for the unfailed aircraft (7-la) and with the left elevator stuck at 3.6 
degrees at t - 4 seconds (7-lb). We notice very little effect in the bank 
response (<f>) during the bank maneuver in which the failure occurred or in 
the subsequent sideslip response. The pitch response with the left elevator 
failure shows slightly greater coupling during these lateral maneuvers but 
follows the pitch command nearly as well as with no failure. Surprisingly, 
little coupling in the lateral axis occurs during the pitch maneuver with 
the stuck elevator failure. Figures 7-2 and 7-3 show the control usage for 
the no— failure and left elevator stuck failure cases, respectively. Notice 
that the disturbance caused by the stuck off-centered elevator is compensated 

by a small amount of differential stabilator which is not present when there 
is no failure. 

Figures 7-4 through 7-7 examine the impact of a stuck rudder failure 
occurring during a sideslip maneuver. Figure 7—4 shows the unfailed responses 
to the baseline sideslip-bank-pitch maneuver sequence. Figure 7-5 and 7-6 show 
the sideslip (6) and bank ($) responses for a stuck rudder failure occurring 
about t — 3 seconds (stuck off-center at about 7 degrees) for a varietv of 
test cases. With no reconfiguration, we see signficant dutch roll oscilla- 
tions as expected from the linear analyses of Section 6. Significant residual 
sideslip is still present at t = 60 secs, (about 55 secs, following the 6=0 
command). The bank maneuver is performed with some loss in performance due to 
the fact that the ailerons become saturated. This occurs because of the sig- 
nificant use of ailerons to counteract the rolling moment of the stuck rudder. 

^ command in the opposite direction, would, of course, not cause aileron 
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Figure 7-4. Normal Response 
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Figure 7-6. Rudder Stuck at 7 Degrees - Bank Responses 
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saturation and presumably result in much improved performance. When the rede- 
signed feedback control gains are employed, we see that, although the dutch 
roll oscillations are still not adequately damped (as expected from Section 6 
analyses), 6 is eventually reduced to near zero. During the bank maneuver, 
coordination is not maintained as desired, but the roll response is much im- 
proved due to the fact that the ailerons no longer saturate. This is because 
the redesigned control law makes greater use of differential elevator and sta- 
bilator in rolling the aircraft to compensate for the lost rudder. When we 
employ a feedforward trim (implemented at the time of failure assuming perfect 
FDI) we see small changes in the g and <j> responses. However, the control 
usage is drastically altered, in general, keeping the stabilators and elevators 
further from their limits and making more use of differential throttle to 
compensate for the yawing moment induced by the stuck rudder. Note that two 
trim cases were examined. In the first case, 8 was constrained as described 
in subsection 6.3 whereas in the second case, 3=0 was added as a condition 
for feasible trim. The trim solution in both cases was feasible (zero error) 
however, it is clear that the control usage is drastically different in these 
two cases. Finally, Fig. 7-7 shows the throttle responses for the various 
test cases. From this figure it is clear that the (steady state) reduction 
in 3 error following a failure is due to the increased use of differential 
throttle controls in the reconfigured cases. 

Figure 7-8 through 7-13 deal with a stabilator runaway failure occurring 
during the normal landing approach (no command generation). In each of these 
cases, both stabilator panels are slewed to their negative limits (trailing 
edge up) at about t = 3 seconds. Also, we employed elevator travel limits of 
±15 degrees (instead of ±20 degree limits assumed in other runs). Figure 7-8 
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Figure 7-10. Stabilator Runaway - Gains and Trim 
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Figure 7-12. Stabilator Runaway - Gains and Trim Delayed by 3 Sec 
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shows various responses to the failure with no reconfiguration. A very high 
pitch attitude (0) is reached before it begins decreasing with what appears 
to be a stable phugoid oscillation. The high pitch attitude is accompanied 
by a reduction of almost 20 knots in airspeed. This reduction comes very 
close to the stall speed of the aircraft and at that time both elevators and 
both ailerons are at their travel limits. No use of throttle is made because 
of the "conflicting" (at least in terms of throttle usage in the nominal con- 
trol system) elements of positive pitch error and negative airspeed error. 

The use of redesigned feedback control gains by themselves provides little 
help in this case as shown in Fig. 7-9. The problem is that, by design, we 
can expect no faster responses from the redesigned control law (the bandwidth 
limits of the original design are maintained) and all control elements, except 
the throttle, reach their saturation limits fairly quickly. The throttle can- 
not, of course, be used alone to recover from the dangerous near stall condi- 
tion and is therefore not used in the redesigned control law. When we add the 
feedforward trim to the RFCS solution, a very reasonable recovery is achieved. 
This is shown in Fig. 7-10. Notice that while the elevators saturate in this 
case too (the trim solution is infeasible), the increased use of elevators, 
ailerons and a throttle reduction, keeps the pitch attitude error from getting 
very large. The velocity is kept large enough to easily avoid a stall by 
its regulation to a new trim value of -11.8 knots below the old trim value. 
Notice that the steady-state pitch attitude and velocity are different than 
the unfailed trim case but that the flight path angle ( y = -3) degrees) is 
maintained reasonably well. 

In Figs. 7-11 through 7-12, we investigated the effect of FDI delay by 
varying the time at which reconfiguration (application of redesigned feedback 
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control gains and feedforward trim) takes place. Figure 7-11 contains a 1 
second delay (before any of the control elements saturate). Fig. 7-12 contains 
a 3 second delay (after the elevators but before the ailerons saturate) and 
Fig. 7-13 contains a 10 second delay (after both ailerons and elevators). As 
expected, recovery performance degrades with increasing FDI delay, however, 
in all cases, performance is better than without reconfiguration. Even with 
a 10 second delay (Fig. 7-13), application of the feedforward trim solution 
causes the throttle to be initially reduced which results in reduction of the 
pitch error before the airspeed is decreased too much. The change of sign in 
the pitch error then causes the elevator to come out of saturation to recover 
the new pitch trim while the throttle is being increased to recover the new 
airspeed trim. This nonstandard combination of control use to avoid stalling 
the aircraft during a stabilator runaway, may be an obvious solution in retro- 
spect. However, the ability to have this solution available, automatically , 
to any pilot is an exciting advance in the potential for increased aviation 
safety. 

In the last set of tests, we examined the impact of uncertainty in the 
FDI algorithm. Figure 7-14 shows various responses to a left elevator failure 
(see Figs. 7-1 through 7-3 for baseline cases) for three different "uncertainty 
cases. The first plot in each series corresponds to an FDI misclassif ication 
in which the left and right ailerons are declared failed instead of the left 
elevator. We then implement only the feedback control gains corresponding to 
a left and right aileron failure. In the second plot of each series we assume 
a naive method of accounting for FDI uncertainty. In this case, since there 
is, by assumption, confusion between three possible failure modes (left ele- 
vator and left and right aileron) we use the feedback gains corresponding to 
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Figure 7-14a. Pitch Responses - Uncertain FDI 
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failure of all three surfaces. Finally, in the last plot of each series, we 
examine the efficacy of utilizing knowledge of uncertainty in the redesign 
method (see Section 4). In the first two cases, the important responses are 
fairly wild. This is, in part, due to the fact that we have three surfaces 
which are not being used for both of these cases. In the last case, we 
assumed the following: 

1. The probability that the left elevator is failed (stuck) 

P 6 » *5» 

2. The probability that the left or right ailerons are failed 
(stuck), P 7 and pg, are .25, 

3. The expected value of the true B matrix is B Q (the unfailed 
B matrix; note that this is formally inconsistent with the 
assumptions I and 2 , but can be justified on other grounds). 

These three assumptions allow us to form the required sta- 
tistics described in Section 4 for computing a redesigned 
control law. In particular, we have (see Eqs. 4-17 and 4-19), 

B f = B 0 

0 for j t i 

• B Q lj • B Q kj otherwise 

aj = Pj(l-Pj) 

where j is the index corresponding to the potentially 
failed surfaces. 

The resulting performance in the last case is clearly superior to either 
of the previous cases. This is due to that fact that all potentially failed 
surfaces have nonzero gains (as expected). Comparing this case to Figs. 7-1 
and 7-3, we see that the command responses are virtually the same as when no 
redesign takes place, however, the control use in achieving these responses 
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.is quite different. It is anticipated that in more severe cases (e.g. f for 
unstable aircraft) that the use of the knowledge about FDI uncertainty in the 
control redesign algorithm would show more dramatic performance improvements 
as compared to the no-redesign case as well as in comparison to FDI misclas- 
sification cases. 
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SECTION 8 


CONCLUSIONS 

This report has presented the results of the last year in a two-year 
effort to develop an automatic control redesign procedure for restructurable 
aircraft control. During the first year of the project, a redesign technique 
was developed for the feedback portion of the flight control system. During 
the second year, this system was tested and integrated with a feedforward 
system for automatically trimming the aircraft to remove the known portion 
of the failure-induced force and moment imbalances. The complete system was 
tested on a nonlinear simulation of a Boeing 737 aircraft that was modified 
to permit individual control surface motion. 

Three important general results were observed. First, the nontraditional 
use of standard control surfaces in a nominal feedback control system to 
spread control authority amongst many redundant (in terms of the forces and 
moments which can be produced) control elements provided a significant amount 
of fault tolerance without any use of restructuring techniques. In most single 
element failures, "recovery" was automatically achieved and little loss in 
command response performance was observed. A stuck rudder failure provided 
the most challenging single element failure situation since it is used exten- 
sively for damping the dutch roll mode and since only weak side forces are 
produced by the other control elements. 
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Secondly, the use of new feedback gains alone (from the feedback control 
redesign procedure but without retrimming) following a failure can provide 
significantly improved recovery as long as the control elements remain within 
their travel limits and as long as uncertainty about the failure identity is 
properly handled. This effect is particularly evident in the stuck rudder 
failure case. When control elements reach their travel limits during a fail- 
ure, performance generally degrades as expected. In failure cases where the 
nominal control system performed well by itself, the application of redesigned 
feedback gains resulted in little, if any, improvement. 

Finally, the use of the feedforward trim solution, in conjunction with 
redesigned feedback gains, allows recovery to take place even when signifi- 
cant control saturation occurs. This is generally due to the fact that servo 
errors resulting from a failure are quickly reduced by application of the 
feedforward trim solution. Since the redesigned control system stabilizes 
the aircraft and the servo errors remain small due to the feedforward trim, 
recovery is generally achieved even when many control elements reach and 
remain at their travel limits. 

In summary, the results to date indicate that the combination of a robust 
nominal controller with an on-line redesign system can accommodate a variety 
of failures and result in a safe stable aircraft. The major program objective 
of developing the control design components of a restructurable control system 
have been met. 

8.1 RECOMMENDATIONS FOR FUTURE WORK 

Several steps remain, however, before a complete restructuring system 
can be implemented. The first is the integration of the redesign system with 
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a Failure Detection and Identification (FDI) system. This integration is the 
subject of the next phase of this project. 

Other issues which need to be addressed in the future include 

1. The need to model the post-failure aircraft, 

2. The need to design the nominal controller, the FDI system, and 
the redesign sysem as a coordinated, fault tolerant whole, 

3. The need to integrate the fault tolerant control system 
(including redesign components) with the rest of the aircraft 
design process, and 

4. The need to verify emergency performance. 

The first issue refers to the need for post-failure aircraft models in the 
redesign system. Although this system is designed to work with uncertain 
aircraft models, and could therefore use stored approximate models for a 
variety of anticipated failures, it can also take advantage of the better 
information which might be available after failure from the use of parameter 
identification procedures. The concepts used to detect and identify the 
failures, explicitly address many problems which are inherent to identifica- 
tion procedures. These procedures should also be useful for estimating the 
failure effects as well. 

The second issue results from the differing abilities of each part of the 
fault tolerant control system for handling different failures. For example, 
those failures which can be handled by passive robustness are likely to be 
the hardest to detect and identify, since the aircraft performance will not 
be seriously affected. Conversely, those failures which result in serious 
performance degradation are also the easiest to find quickly. Such concerns 
point to the need to develop a methodology for designing all the fault tolerant 
controller components in a coordinated manner, so that failures not covered 
by one part of the system can be accommodated by another. 
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Third, the incorporation of a restructurable control system in an air- 
craft must be integrated with the rest of the aircraft design. For example, 
if differential elevator control is incorporated in an aircraft design for 
emergency use in restructuring, then the aircraft structure must be designed 
to accommodate it. This leads to a conflict between designing for normal 
operation and building in margins for emergency use. Although our restruc- 
turing system can accommodate limits on control authority (much as it handles 
bandwidth or travel limitations), the aircraft designer will need to trade 
off the cost of such limits in terms of failure coverage against the cost in 
structure. Tools to accomplish this multidisciplinary trade-off will be 
needed. 

Finally, the restructurable control system will need to be flight tested 
to investigate its performance under real-world conditions. An important 
issue in such testing (and in subsequent validation of production designs) is 
the simulation of failures and their effects. Such testing under realistic 
conditions is essential to demonstrate the technology and bring it out of the 
research stage. 


144 



REFERENCES 


1. Looze, D.P., S. Krolewski, J.L. Weiss, N.M. Barrett, and J.S. Eterno, 
"Automatic Control Design Procedures for Restructurable Aircraft Control," 
NASA CR- 17 24 89 , Contract NAS1-17411, January 1985. 

2. McMahan, J., "Flight 1080," Air Line Pilot , July 1978. 

3. "National Transportation Safety Board Accident Report of the American 
Airlines DC10 Crash at Chicago - O'Hare International Airport, May 25, 
1979, NTSB-AAR-79-17, December 21, 1979. 

4. Weiss, J.L., "A Decentralized Approach to Design of Robust Failure 
Detection and Isolation (FDI) Algorithms," ALPHATECH Technical Memorandum 
TM-186 , July 1985. 

5. Weiss, J.L., J.M. Stifel, and K.S. Govindaraj, "Flight Test Results of 
a Control Element FDI Algorithm," Presented at NAECON '86 , Dayton, OH. 

6. Deckert, J.C., M.N . Desai, J.J. Deyst, and A.S. Willsky, "F8-DFBW Failure 
Identification Using Analytic Redundancy,” IEEE Transactions on Automatic 
Control , Vol . AC-22, No. 5, October 1977, pp. 795-803. 

7. Deckert, J.C., "Flight Tests Results for the F-8 Digital Fly-by-Wire 
Aircraft Control Sensor Analytic Redundancy Management Technique," 
Proceedings of the AIAA Guidance and Control Conference , Albuquerque, 

New Mexico, August 1981, pp. 491-499 . 

8- Pattipati, K.R. , A.S. Willsky, J.C. Deckert, J.S. Eterno, and J.L. Weiss, 
"A Design Methodology for Robust Failure Detection and Isolation,” 1984 
American Control Conference , San Diego, CA, June 1984. 

9. Weiss, J.L., A.S. Willsky, K.R. Pattipati, and J.S. Eterno, "Application 
of FDI Metrics to Detection and Isolation of Sensor Failures in Turbine 
Engines," 1985 American Control Conference , San Diego, CA, June 1984. 

10. Willsky, A.S., "A Survey of Design Methods for Failure Detection in 
Dynamic Systems," Automatica , Vol. 12, 1976, pp. 601-611; also in 
AGARDograph No. 224 on "Integrity in Electronic Flight Control Systems." 

11. Lou, X.— C., A.S. Willsky, and G.C. Verghese, "Failure Detection with 
Uncertain Models," Preprint Sept. 1982, invited paper for 1983 American 
Control Conference, June 1983. 


145 



12* Weiss, J.L., A.S. Willsky, D.P. Looze, J.T. Crawford, and R.R. Huber, 
"Detection and Isolation of Control Surface Effectiveness Failures in 
High Performance Aircraft," in IEEE Proceedings of NAECON , May 1985. 

13. Gilmore, J.P., and R*A. McKern, "A Redundant Strapdown Inertial Reference 
Unit (SIRU)," J. Spacecr. Rockets , January 1972. 

14. Daly, K. , et al., "Generalized Likelihood Test for FDI in Redundant 
Sensor Configurations," J. Guidance and Control , Vol. 2, No. 1, January - 
February 1979. 

15. Eterno, J.S., J.L. Weiss, D.P. Looze, and A.S. Willsky, "Design Issues 
for Fault Tolerant-Res tructurable Aircraft Control," ALPHATECH Technical 
Paper TP-225, presented at the 1985 Conference on Decision and Control , 
Fort Lauderdale, FL, August 1985. 

16. Eterno, J.S., J.L. Weiss, D.P. Looze, and A.S. Willsky, "Restructurable 
Control of High Performance Aircraft," ALPHATECH Technical Paper TP-227, 
Presented at the 1985 AIAA Guidance and Control Conference , Snowmass, CO, 
August 1985. 

17. Looze, D.P., J.L. Weiss, J.S. Eterno, and N.M. Barrett, "An Automatic 
Redesign Approach for Restructurable Control Systems," ALPHATECH Technical 
Paper TP-205-1, IEEE Control Systems Magazine , May 1985. 

18. Weiss, J.L. and D.P. Looze, "Further Development of an Automatic Control 
Design Procedure for Restructurable Aircraft Control, ALPHATECH Technical 
Report TR-249, Second Quarterly Report, June 1985. 

19. Gill, P. et al., Practical Optimization , Academic Press, New York, 1981. 

20. Luenberger, D., Introduction to Linear and Nonlinear Programming, 
Addison-Wesley , Reading, MA, 1973 . 

21. Huber, R. and B. McCullough, "Self-Repairing Flight Control Systems, 
Society of Automotive Engineers, Paper #SAE-841552, presented at 
Aerospace Congress and Exposition , Long Beach, CA. , October 1984. 

22. "Self-Repairing Digital Flight Control System, Contract F33615-80-C-3100 , 
Final Report, General Electric, July 1984. 

23. Athans, M., "The Role and Use of the Stochastic Linear— Quadrat ic-Gaussian 
Problem in Control System Design," IEEE Transactions on Automatic Control, 
Vol. AC-16, December 1971, pp. 529-552. 

24. Doyle, J.C. and G. Stein, "Multivariable Feedback Design: Concepts for 

a Classical/Modern Synthesis," IEEE Transactions on Automatic Control , 

Vol. AC-26, No. 1, February 1981. 

25. Stein, G. and M. Athans, "The LQG/LTR Procedure for Multivariable Feedback 
Control Design," submitted to IEEE Transactions on Automatic Control. 


146 


26. Kalman, R.E., "When is a Linear Control System Optimal?" Journal of Basic 
Engineering , Transactions of ASME, Series D, Vol. 86, March 1984. 

27. Horowitz, I.M., Synthesis of Feedback Systems, Academic Press. New York. 
1963. 

28. Cruz, J.B., J.S. Freudenberg, and D.P. Looze, "A Relationship Between 
Sensitivity and Stability for Multivariable Feedback Systems," IEEE 
Transactions on Automatic Control , Vol. AC-26, No. 1, February 1981 . 

29. Safonov, M.G., A.J. Laub, and G.L. Hartman, "Feedback Properties of 

Multivariable Systems: The Role and Use of the Return Difference 

Matrix,” IEEE Transactions on Automatic Control , Vol. AC-26, No. 1, 
February 1981. 

30. Bode, H.W., Network Analysis and Feedback Amplifier Design , Van Nostrand, 
Princeton, NJ, 1945. 

31. Horowitz, I.M., Synthesis of Feedback Systems, Academic Press, New York. 
1963. 

32. Ryneski, E.G. and K.S. Govindaraj, "Control Concepts for the Alleviation 
of Wind Gusts," NASA CR-166022, Contract NAS1-16691, July 1982. 

33. Etkin, B., Dynamics of Atmospheric Flight , Wiley and Sons, Inc., 

New York, 1947. 

34. Klema, V.C. and A.J. Laub, "The Singular Value Decomposition: Its 

Computation and Some Applications,” IEEE. 


147 



Standard Bibliographic Page 


J. Report No. 2. Government Accession No. 

NASA CR- 178064 

3. Recipient’s Catalog No. 

4. Title and Subtitle 

Initial Design and Evaluation of Automatic 
Restructurable Flight Control System Concepts 

5. Report Date 

June 1986 

6. Performing Organization Code 

7. Author(s) 

J.L. Weiss, D.P. Looze, J.S. Eterno, D.B. Grunberg 

8. Performing Organization Report No. 

TR-269-1 

i 9. Performing Organization Name and Address 

‘ ALPHATECH, Inc. 

j 

! 10. Work Unit No. 

2 Burlington Executive Center 
111 Middlesex Turnpike 
Burlington. MA 01803 

11. Contract or Grant No. 

NAS 1-1741 1 

13. Type of Report and Period Covered 

Contractor Rpt 11/85-11/86 

12. Sponsoring Agency Name and Address 

NASA-Langley Research Center 
Hampton, VA 23665 

14. Sponsoring Agency Code 


j 15. Supplementary Notes ! 

i Annual Report j 

j i 


| 16. Abstract I 

! i 

! i 

i This report presents the results of a two-year effort sponsored by the NASA 

i Langley Research Center under contract NAS1-17411 to develop automatic control 
j design procedures for restructurable aircraft control systems. The restructurable \ 
| aircraft control problem involves designing a fault tolerant control system which ! 

can accommodate a wide variety of unanticipated aircraft failures. Under NASA I 

; sponsorship, sorship, ALPHATECH has been developing and testing many of the tech- 
1 nologies which make such a system possible. Future work under this contract will ; 
I focus on developing a methodology for integrating these technologies and deraon- 
jstration of a complete system. 


, 17. Key Words (Suggested by Authors(s)) 

Fault Tolerant Control 
Reconfiguration 


: 18. Distribution Statement 
I 

| Unclassified-Unlimited 


19. Security Classif.(of this report) 

20. Security Classif.(of this page) 

21. No. of Pages 

22. Price 

Unclassified 

Unclassified 

162 



For sale by the National Technical Information Service, Springfield, Virginia 22161 
NASA Langley Form 63 (June 1985) 


148 








3 1176 01310 5714 


